Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects a node.exe process spawned by VS Code (Code.exe) performing sandbox/CI-CD evasion checks associated with the malicious @jaymara/jsononifier npm dependency, including a filesystem existence check for '/.dockerenv' or file access under a folder path referencing the @jaymara/jsononifier package prior to XOR-decoded payload execution.
Detects execution of processes associated with the CrySome Remote Access Trojan (RAT), identified by known binary names ('patch_diag.exe', 'patch.exe') or file hash. Additionally, it monitors for outbound network connections to a specific, hardcoded C2 IP address (193.26.115.42) on port 5555, which is associated with CrySome RAT's hVNC-enabled client.
Detects high-integrity or system-level processes launched by specific shellcode-like filenames or processes containing 'ICMLuaUtil' in the command line. This technique is often indicative of a UAC bypass attempt, where malicious actors attempt to elevate privileges by abusing the ICMLuaUtil COM interface, while excluding the standard Windows consent dialog processes.
Detects the use of the built-in Windows utility esentutl.exe to copy sensitive registry hives (SAM, SECURITY, or SYSTEM). This is a known technique used by adversaries to perform offline credential dumping by accessing the registry hive files.
Detects the legitimate WinDirStat.exe binary loading a malicious uxtheme.dll from a non-standard directory (C:\ProgramData\WinDir\). This pattern is consistent with DLL side-loading techniques, specifically those associated with the SysAid update supply chain compromise.
Detects potential local privilege escalation attempts leveraging the AnyDesk printer named pipe (adprinterpipe). The rule monitors for the creation of the adprinterpipe, the spawning of processes with SYSTEM privileges from an AnyDesk parent, and the loading of suspicious DLLs by AnyDesk, which are indicative of an exploit leveraging insecure COM unmarshaling callbacks.
Detects DLL search order hijacking of legitimate Windows binaries consent.exe or icardagt.exe. The rule triggers when these binaries are executed from non-standard, user-writable directories (e.g., %TEMP%, %APPDATA%), which is a common technique used by the BumbleBee malware loader to sideload a malicious msimg32.dll.
This rule detects the execution of processes named 'MiniBrowse' or access attempts to common web browser credential storage files (Google Chrome 'Login Data', Microsoft Edge 'Login Data', and Mozilla Firefox 'logins.json' or 'key4.db'). These patterns are characteristic of browser credential stealing malware or unauthorized data collection tools.
Detects the execution of known Mimikatz credential dumping commands, specifically 'lsadump::dcsync' used for Active Directory credential extraction, and 'sekurlsa' used for extracting credentials from the LSASS process memory.
This rule detects potential malicious activity where PowerShell is used to write base64-encoded files disguised with non-script extensions (e.g., .ini), which are subsequently decoded using 'certutil.exe -decode' and executed via 'wscript.exe'. This chain is a common technique used to bypass security controls by obfuscating script content and utilizing legitimate system binaries for deobfuscation and execution.
This rule monitors for the execution of known software utilities often used by adversaries to disable security controls, remove system locks on files, or tamper with security configurations. Specifically, it flags the usage of IObit Unlocker, Gmer (a known rootkit/tampering tool), and Defender Control (used to disable Windows Defender).
Detects suspicious PowerShell execution patterns characterized by the 'ClickFix' social engineering technique. This involves an attacker tricking a user into copying and pasting a PowerShell command into their terminal, often disguised as a fake reCAPTCHA or security verification page. The rule monitors for PowerShell processes spawned by common user-facing applications (explorer.exe, conhost.exe, WindowsTerminal.exe) that contain specific command-line arguments like 'iex(irm' or 'iex(iwr'.
Detects processes that execute commands involving SQL database operations, specifically those related to AES encryption functions or table management (create/drop operations) on configurations. This activity is often associated with potential database manipulation or data destruction attempts by an attacker.
This rule monitors for the execution of the 'pg_dump' utility by Python-based applications (like Langflow), followed by the deletion of a file on the same host within 60 minutes. This behavior may indicate an adversary staging data, dumping a database, and then attempting to remove evidence of the activity.
This rule detects Python processes initiated or executed in association with 'langflow'. It flags instances where Python is invoked with command-line arguments containing Base64 decoding patterns or '-c' flags, which are commonly used by attackers to execute obfuscated or staged payloads within a Python environment.
This rule detects the execution of Python or MySQL command-line utilities where the command line contains strings indicative of 'mysql.func'. This pattern is often associated with the loading of malicious UDFs (User Defined Functions) or other exploitation techniques targeting database environments through script interpreters.
This rule monitors process command lines for strings associated with sensitive API keys (e.g., OpenAI, Alibaba, Huawei, Tencent, Aliyun) or seed phrases. It triggers an alert when two or more distinct patterns are identified on the same host, indicating potential credential harvesting or discovery activities.
Detects command-line execution of database drop operations combined with the disabling of foreign key constraints, which is indicative of malicious database manipulation or automated data destruction attempts.
Detects the execution of Python processes via the command line that include both the '-c' flag for executing inline code and specific code patterns related to network data retrieval ('urllib.request.urlopen') or decoding obfuscated data ('base64.b64decode'). This behavior is commonly used by adversaries to download and execute secondary payloads or handle C2 communication.
Detects the creation of suspicious scheduled tasks using the 'schtasks.exe' utility. The rule flags tasks that are created from suspicious paths (e.g., Temp, ProgramData), tasks executing common script extensions (vbs, ps1, bat, hta, js), or tasks that masquerade as legitimate Windows or System update tasks.
This rule detects potentially malicious behavior involving the abuse of legitimate Windows binaries 'certutil.exe' and 'wscript.exe'. It flags specific command-line patterns often associated with deobfuscating, decoding, or staging payloads, such as using certutil to decode files or interact with web caches, and using wscript to execute vbscript from suspicious files like 'Link.ini' or 'Link.dat'.
Page 342 of 977