Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule monitors for a suspicious execution pattern where a browser (Chrome or Edge) is launched with specific command-line flags ('--no-first-run', '--disable-gpu', 'about:blank') by a non-standard parent process, followed shortly by the loading of the 'elevation_service.exe' from 'services.exe' and the loading of 'DPAPI.dll' by the browser process. This sequence is often associated with automated browser credential dumping activities, where attackers attempt to bypass UI requirements or programmatically extract secrets from the browser's credential storage.
Detects rapid, suspicious command-line activity indicative of unauthorized user account creation or modification within a database environment, specifically targeting 'xadmin' or 'ROLE_ADMIN' roles accompanied by password hashing commands. The rule monitors for multiple events within a 120-second window to identify potentially automated or batch unauthorized account provisioning.
Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.
This rule detects potentially malicious MySQL database operations involving sensitive file access or suspicious data exportation. It monitors for the use of 'INTO OUTFILE' commands pointing to sensitive paths (like /var/lib/mysql-files/) or the use of 'LOAD_FILE' commands to access system files such as /var/run/docker.sock, /proc/1/cgroup, or /proc/1/mountinfo, which are indicative of attempts to exfiltrate database content or escape a container environment.
This rule detects potential adversary reconnaissance behavior by identifying hosts executing a combination of common system and network enumeration commands (id, uname, hostname, ifconfig/ip) in short succession. Detecting multiple distinct reconnaissance commands from a single process context may indicate an interactive shell session being used to gather information about the environment.
Detects the execution of known command-line artifacts and tools associated with direct and indirect system call resolution, such as SysWhispers, HellsGate, and HellHall. These techniques are commonly employed by adversaries to bypass user-mode EDR hooks by invoking NT syscalls directly.
Detects instances where the Claude Code AI agent process spawns shell interpreters (bash, sh) or network utilities (curl, wget, dig, nslookup) with potentially malicious command line arguments. This behavior can be indicative of indirect prompt injection or unauthorized remote code execution attempts, such as reverse shells, base64 encoded payloads, or DNS-based exfiltration.
Detects the use of the 'security' command-line utility to interact with the 'login.keychain-db' file on macOS, which is a common technique used by adversaries to dump credentials.
Detects the execution of processes containing command-line arguments '-debugport' or '-lport'. These flags are often used to configure remote debugging or listen ports, which can be abused by adversaries for persistence or command and control (C2) communication.
Detects the use of reg.exe to modify Windows Registry keys related to disabling or tampering with Windows Defender security settings, such as Real-time Monitoring, Tamper Protection, and various scanning features.
Detects the execution of 'ElevatorShellCode.exe' or the presence of 'ICMLuaUtil' in command-line arguments. 'ICMLuaUtil' is a known Windows COM interface frequently abused for UAC bypass and privilege escalation, while 'ElevatorShellCode' is indicative of suspicious tools attempting to gain higher integrity levels.
Detects the PowerShell command lines with special characters
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Detects instances where common scripting or package management tools (e.g., node.exe, python.exe, pip.exe, npm.exe) launch Windows command line interpreters (powershell.exe, cmd.exe, wscript.exe, etc.) with command-line arguments indicative of potentially malicious activity, such as base64-encoded strings, command execution flags, or high-entropy command lines.
Detects a malicious HTA lure disguised as a military pay calculator. The attack involves a JScript routine that renames an embedded data file ('styles.dat') to an executable ('styles.dat.exe') and triggers its execution, characteristic of a spearphishing attachment delivering malware.
Detects the installation of an attacker-controlled root certificate into the Windows certificate store using certutil.exe. This activity is correlated with the modification of Firefox browser settings to trust the Windows OS certificate store, an action often performed to facilitate TLS interception and traffic stripping.
Detects the presence and execution of components associated with the 'Exploitarium' toolkit, a collection of exploit harnesses and proofs-of-concept. The rule monitors for process execution of specific filenames, file creation events, persistence via registry-based service installation, and image loads related to the toolkit's binaries.
This rule detects the use of GSocket and GS-Netcat utilities, which are often used for creating reverse shells and persistent network tunnels. It monitors for either direct network connections associated with these tools or command-line activity indicating these tools are being configured for persistence using cron jobs, systemd services, or @reboot triggers.
Detects the execution of ADExplorer.exe, a legitimate administrative tool often abused by attackers to export Active Directory data. The rule specifically flags instances where the command line arguments include '-snapshot' or specify a '.dat' output file, which are strong indicators of unauthorized Active Directory data extraction or staging for offline analysis.
Detects the execution of Microsoft HTML Help (hh.exe) with a .chm file in the command line. Adversaries often use Compiled HTML files (.chm) to conceal malicious code and bypass security controls, as they can execute scripts or launch other payloads when opened.
Detects the execution of Certutil.exe with specific command-line arguments (-decode, -urlcache, -split) or references to suspicious file patterns (Link.dat, Link.ini) which are often indicative of malicious activity such as downloading remote payloads, decoding obfuscated binaries, or staging files for lateral movement.
Page 345 of 977