Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of Microsoft Quick Assist (or related Remote Desktop clients) shortly after activity from Microsoft Teams. This pattern is consistent with social engineering tactics where an attacker impersonates IT personnel over a Teams call to persuade a victim to provide remote access to their workstation.
Detects package manager lifecycle scripts (npm, yarn, pnpm, composer, go) spawning child processes that perform suspicious activities, including network connectivity (curl, wget) or execution of obfuscated JavaScript (base64/fromCharCode/eval), often indicative of supply chain attacks like the PolinRider campaign.
Detects the execution of reverse engineering tools like Ghidra, Binary Ninja, or IDA Pro when their command-line arguments reference paths or names associated with EDR sensor drivers, binaries, or services. This behavior is indicative of an adversary conducting analysis of security software to identify potential blind spots or tampering opportunities.
Detects attempts to perform container escapes or escalate privileges within a Gitea Actions runner environment. The rule monitors for the execution of dangerous container options (e.g., --pid=host, --privileged, --cap-add=ALL) in CI/CD workflow configurations, the spawning of 'nsenter' by the runner process, and writes to sensitive host system paths from containerized processes.
This rule detects the presence and execution of files and scripts associated with the exploitation of CVE-2026-55200, such as harness binaries and proof-of-concept scripts. Additionally, it identifies post-exploitation behavior where common network-related processes (like curl, git, or sshd) spawn suspicious or unexpected child processes, which may indicate successful code execution or lateral movement originating from the compromised service.
Detects anomalous process execution chains originating from the Gitea server or Gitea act-runner processes following the exploitation of CVE-2026-20896. This vulnerability allows an attacker to bypass authentication using a forged X-WEBAUTH-USER header when REVERSE_PROXY_TRUSTED_PROXIES is insecurely configured. The rule identifies subsequent command-line activity such as spawning shells, using network utilities (wget, curl, netcat), or executing Gitea administrative commands by unauthorized child processes.
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
Detects instances where FortiTray.exe or scheduler.exe (associated with FortiClient) initiate a cmd.exe process that subsequently launches a PowerShell process with hidden window (-w 1) and encoded command (-enc) flags. This pattern is indicative of a living-off-the-land attack where a legitimate, signed application process is abused to execute obfuscated malicious payloads.
Detects the execution of known Windows binaries (fodhelper.exe, eventvwr.exe, computerdefaults.exe) which are frequently abused for User Account Control (UAC) bypass by exploiting their auto-elevation capability. These binaries are monitored as either the parent process or the target image, which is a common indicator of a UAC bypass attempt.
Detects the execution of systeminfo.exe or wmic.exe that terminates within 5 seconds. This behavior is indicative of automated environment or sandbox discovery techniques, often performed by malware loaders such as those associated with the Turb00 operation or similar campaigns to fingerprint the victim machine prior to executing malicious payloads.
Detects the use of the Python psutil library to query network interface MAC addresses in order to identify potential virtual machine environments, a technique often used by the LIUSHEN malware to evade sandbox analysis.
Detects PowerShell execution involving reflection patterns (GetMethod('C') and Invoke) combined with the execution or targeting of known Living-off-the-Land binaries (LOLBins). This pattern is often used to execute malicious payloads in-memory, bypassing traditional signature-based detection.
This rule detects the execution of the AD Explorer tool followed by the creation of a .dat file within a 10-minute window. AD Explorer is a known administrative tool often used by adversaries for Active Directory reconnaissance, and creating or saving files with a .dat extension may indicate the export of captured AD data for further analysis or exfiltration.
Detects the use of the Windows Certutil utility to decode files or extract items from the cache, specifically looking for indicators often associated with file reassembly or extraction of payload components such as Link.dat or Link.ini files.
This rule detects the execution of PowerShell via wscript.exe or certutil.exe, followed by the use of suspicious command-line arguments often associated with malicious fileless execution, such as downloading content from the web or executing base64 encoded payloads.
Detects instances where cmd.exe spawns powershell.exe with command-line arguments indicative of malicious activity, such as network connection attempts via TCPClient or the use of Base64 encoded commands.
Detects activity associated with the 'MiniBrowse.exe' process, which exhibits behaviors characteristic of unauthorized browser credential and cookie harvesting. This includes targeting browser 'Login Data' files, accessing cookies, attempting to interact with legitimate browser processes (chrome.exe, msedge.exe) via cross-process operations, and writing logs to 'edgeLog.txt'.
Detects the spawning of cmd.exe from common user-facing applications (e.g., Microsoft Office, web browsers, PDF readers) with command line arguments containing '/c'. This behavior is frequently associated with malicious document execution, drive-by downloads, or other initial access techniques where an attacker attempts to break out of the application sandbox to execute secondary payloads or perform reconnaissance.
Detects in-memory shellcode execution chains associated with BeepRAT and DcRAT. This includes the use of TCC (Tiny C Compiler) with specific flags for in-memory execution and LuaJIT FFI calls used to invoke Windows kernel functions (VirtualAlloc/CreateThread) for shellcode injection.
Detects the execution of PowerShell with flags indicating encoded commands (-enc) or hidden window styles (-windowstyle hidden), which are common techniques used to obfuscate malicious activity or run payloads stealthily. This behavior is often associated with the post-compromise execution phase of various threats, including payloads delivered via malicious portals.
Detects attempts to clear Windows Event Logs using either the command-line utility 'wevtutil.exe' or the PowerShell cmdlet 'Clear-EventLog'. Additionally, it monitors for Windows Security Event ID 1102, which specifically indicates the clearing of the Security log. These actions are common indicators of an adversary attempting to remove evidence of their activity from a host system.
Page 348 of 977