Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects potentially malicious activity involving the ServiceModelReg.exe process, a known vector for ResiLoader process hollowing. It monitors for cross-process injection (e.g., process hollowing) and process creation events where ServiceModelReg.exe is spawned by suspicious parent processes (such as scripting engines) or originates from an unexpected location.
Detects the execution of PowerShell with a suspicious download cradle pattern ('iex(irm)') that includes '-UseBasicParsing'. The process is specifically monitored when spawned from the Windows Run dialog (explorer.exe), a behavior frequently associated with the ClickFix social engineering campaign where users are tricked into executing malicious commands under the guise of fake security verification.
Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.
This rule detects the execution of mitmproxy, mitmweb, or mitmdump in reverse-proxy mode configured specifically to target login.microsoftonline.com. This behavior is highly characteristic of an adversary setting up an Adversary-in-the-Middle (AiTM) platform to perform TLS interception on authentication traffic, potentially leading to credential and session cookie theft.
Detects the execution of cron jobs that utilize file transfer utilities (curl, wget) piped directly into a shell (sh, bash). This is a common "living off the land" technique used by attackers to fetch and execute remote malicious payloads for initial staging and persistence.
Detects Python command lines referencing the specific authencesn cryptography string used to exploit the Copy Fail vulnerability (CVE-2026-31431).
Usermod to root
Sigma
Detects the use of the usermod to modify the users permissions.
Which can be an indication of privilege escalation attempts on Linux systems
Which can be an indication of privilege escalation attempts on Linux systems
This rule detects the execution of cmd.exe with a command line argument (/c) spawned directly from common application entry points such as Microsoft Office (Word, Excel, PowerPoint, Outlook) or scripting engines (wscript.exe, cscript.exe). This pattern is a common indicator of malicious macro-based execution, weaponized document exploitation, or script-based secondary payload execution.
Detects the execution of a hidden PowerShell process that initiates a TCP network connection using the .NET System.Net.Sockets.TCPClient class. This pattern is commonly used in fileless reverse shell implementations where a command-line process (like cmd.exe) spawns PowerShell to establish an outbound connection to an attacker-controlled remote host.
Detects enumeration of local system accounts on MacOS systems.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.
Detects processes attempting to masquerade as legitimate Cortex XDR components by including vendor-specific internal paths (e.g., cyserver, tdevflt) in their command-line arguments. Attackers may use this technique to trick endpoint security products into bypassing telemetry collection or applying incorrect exclusion policies based on matching path patterns.
This rule detects a multi-stage attack chain associated with the SnappyClient RAT (Operation Turb00). The detection logic correlates: 1. Execution of known malicious processes (AlphVector, WizardDa42, VirtualAr, or Crisp); 2. Persistence mechanisms including specific registry keys (CadenceOptimizer) or file artifacts (shortcut links, scheduled tasks, Mayanex data dir, or CorsairUtil DLL); and 3. Outbound network traffic on ports 3333 or 3334 to external IP addresses.
Detects potential remote code execution (RCE) via CVE-2026-55200 in libssh2-linked applications. The rule monitors for two signals: firstly, a post-exploitation child process (such as a shell or interpreter) spawned by a common libssh2-reliant application (e.g., ssh, curl, git, php) shortly after an outbound connection to TCP ports 22 or 2222; secondly, anomalous outbound network connections to port 2222 originating from these same libssh2-linked binaries.
Detects anomalous activity associated with the exploitation of RustDesk session permission bypass vulnerabilities. Specifically identifies 'rustdesk.exe' spawning suspicious child processes (indicative of post-exploitation command execution) or initiating outbound network connections on non-standard relay ports, which may signal a compromised remote access session.
This rule detects a suspicious process execution chain where the FortiClient scheduler (scheduler.exe) initiates a command-line interpreter (cmd.exe) to execute a batch file, which subsequently launches a PowerShell process with obfuscated or hidden command-line arguments (e.g., -w 1, -enc). This chain is often indicative of post-exploitation activity, specifically related to the FortiBleed vulnerability chain or the deployment of infostealers.
Detects DLL side-loading attempts and suspicious process executions associated with the HijackLoader (wingo) malware distribution chain. The rule monitors for specific common applications loading known vulnerable DLLs from suspicious non-standard directories (e.g., ProgramData, Temp) and tracks rare parent-child process relationships associated with this campaign.
Detects instances where a PowerShell process makes an outbound network connection shortly after its initial launch. This behavior is consistent with ClickFix campaigns or other malicious activity where PowerShell is utilized to download secondary payloads, such as stealers or loaders, directly from the internet.
Detects access to sensitive browser internal pages (profile-internals) via command line or the generation of error PDF files, which may indicate browser-based reconnaissance, credential harvesting, or data exfiltration attempts.
Detects processes attempting to copy or access browser cookie files, indicated by strings associated with unauthorized data collection tools or custom scripts.
Detects execution of PowerShell commands that contain strings indicative of an in-memory AMSI (Antimalware Scan Interface) bypass. The rule searches for the combination of memory manipulation API calls (VirtualProtect, LoadLibrary, GetProcAddress) and specific byte signatures (0xB8, 0xC3) often used to patch AMSI in the current process memory.
Detects the creation of a scheduled task via schtasks.exe identified by the specific command-line string associated with 'CrysomeLoader', configured to execute every 5 minutes.
Page 341 of 977