Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution or presence of processes associated with the 'dogleash' tool, specifically identifying command lines or file paths that contain architectural references such as 'mips', 'arm', or 'x64', which is indicative of potential cross-platform malware or backdoor deployment.
Detects attempts to disable Windows Defender real-time protection, behavior monitoring, or scan capabilities. This is achieved by monitoring for specific HKLM registry modifications under 'SOFTWARE\Policies\Microsoft\Windows Defender' or the execution of PowerShell cmdlets 'Set-MpPreference' and 'Add-MpPreference' with arguments designed to disable security features or add file/process exclusions, often observed during initial stages of ransomware attacks.
Detects instances where the Console Host process (conhost.exe) is executed at a System integrity level with a parent process of the Windows Error Reporter (wermgr.exe). This pattern is atypical as conhost.exe typically runs within the context of the user session or the initiating process, and spawning it from wermgr.exe at System level may indicate an attempt to hide a console window or manipulate system processes via an elevated parent.
Detects the persistence and execution mechanism of ChocoPoC RAT, where a Python interpreter is spawned in a hidden window using the CREATE_NO_WINDOW flag (0x08000000). The rule monitors command-line arguments and parent-child process relationships for indicators of the RAT's module import, specific environment variables used for anti-recursion loops, and process spawns originating from existing Python instances.
Detects unauthorized child process creation by the Windows Error Reporting Manager (wermgr.exe). The rule identifies scenarios where wermgr.exe, executed under the SYSTEM context via the QueueReporting scheduled task (often abused in the RoguePlanet exploit chain), spawns interactive shells or command processors like cmd.exe, powershell.exe, or cscript.exe. Legitimate instances of wermgr.exe do not spawn interactive user interfaces or shells.
Detects the execution of known Remote Monitoring and Management (RMM) tools (AnyDesk, SyncFuture, QuickAssist, etc.) when launched by suspicious or untrusted parent processes. Additionally monitors for non-standard installation paths for AnyDesk and the creation of persistence registry keys for these RMM tools.
Detects instances where the Argo CD repo-server or kustomize processes spawn unexpected child processes, such as shells or network utilities. This behavior is indicative of potential command injection, specifically concerning the unauthenticated GenerateManifest gRPC service vulnerability (CVE-2024-31989), where an attacker could execute arbitrary code on the underlying host or container.
Detects specific User Account Control (UAC) bypass techniques involving fodhelper.exe, eventvwr.exe, and sdclt.exe, often used in conjunction with PowerShell 'RunAs' elevation to install system-level tools like Tailscale or OpenSSH, as observed in Operation Poisson.
Detects execution of PowerShell with encoded commands ('-enc') and window style hidden ('-w 1') initiated by processes associated with Fortinet FortiClient (e.g., scheduler.exe, fortitray.exe), or matching known encoded command patterns. This often indicates the use of legitimate management processes to execute obfuscated malicious scripts.
Detects potential exfiltration activity involving PowerShell scripts interacting with a specific remote IP address, using System.Net.WebClient to upload file contents, and referencing a common local staging file (C:\ProgramData\log.txt).
Detects anomalous system reconnaissance and potential anti-VM sandbox evasion behaviors exhibited by processes. The rule aggregates distinct indicators such as system information gathering (systeminfo, wmic), virtualization environment probing (VMware Tools detection), registry-based identity checks (MachineGuid, ComputerName), and broad enumeration of HKLM\SOFTWARE vendor keys, identifying processes that perform three or more of these distinct actions within a 5-minute window.
Detects the EKZ Stealer malware masquerading as a legitimate Fortinet update process (FortiEndpoint_Patch.exe). The rule monitors for the execution of this specific filename or hash, identifies suspicious command-line arguments (list, search, view, label, export) indicating credential theft activities, and alerts on the creation of the binary and subsequent log files within the ProgramData directory.
Detects the execution of 'kustomize' with the '--helm-command' flag configured to use a non-standard binary or script. When triggered within the context of an Argo CD repo-server, this behavior indicates a potential exploitation attempt of CVE-2024-31989, which allows for arbitrary command execution under the repo-server process context by coercing Kustomize to execute malicious files.
Detects the execution of FortiEndpoint_Patch.exe with specific command-line arguments used for configuration or information gathering.
Detects the execution of PowerShell with security-bypassing flags (-ExecutionPolicy Bypass, -NoProfile, -WindowStyle Hidden) launched by the Windows Script Host (wscript.exe). This pattern is associated with the VEIL#DROP campaign where JavaScript lures invoke PowerShell to bypass AMSI and security controls.
This rule detects the execution of Python (pip) or Node.js (npm) package managers with command-line arguments specifying alternative package repositories (e.g., --index-url, --registry) that do not belong to the standard, trusted public repositories (pypi.org or npmjs.com/npmjs.org). This behavior is often indicative of supply chain attacks, where attackers attempt to trick users or automated systems into installing malicious dependencies from compromised or attacker-controlled repositories.
Detects usage of pip or npm package managers where non-canonical registry or index URLs are explicitly specified. This behavior can be indicative of software supply chain poisoning, specifically attacks involving typo-squatting or AI-hallucinated malicious package repositories.
Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender.
SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks.
However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns.
SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks.
However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns.
Detects suspicious process execution by GitHub Runner.Worker or Runner.Listener on CI runners. It specifically targets the execution of scripts or binaries associated with compromised action components (such as trivy-action or setup-trivy) where version tags have been tampered with to inject credential-harvesting code. The rule monitors for unauthorized command line arguments or file paths linked to these components.
This rule detects command-line arguments and file names associated with the execution of Mimikatz or derived tools (such as SafetyKatz). It monitors for specific modules and flags, including credential harvesting (sekurlsa, lsadump, vault), DPAPI operations, and Kerberos manipulation, which are characteristic of adversary credential theft and privilege escalation activities.
Detects the creation of a new local user account on a Windows system using the net.exe or net1.exe command-line utilities. This is a common technique used by attackers for establishing persistent access to a compromised system.
Page 346 of 977