Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects indicators of exploitation attempts against the CVE-2026-55200 libssh2 heap out-of-bounds write vulnerability. The rule identifies the creation of known PoC artifacts on disk, execution of exploit harnesses or probe binaries, Python scripts masquerading as or interacting with the PoC server, and libssh2-dependent client applications making network connections to the non-standard port 2222 used by the exploit scaffold.
Detects potential privilege escalation attempts targeting AnyDesk runtime via named pipe exploitation. The rule monitors for unauthorized cross-process access to AnyDesk processes, AnyDesk spawning suspicious child processes indicative of post-exploitation activity, and the execution of a known vulnerable AnyDesk binary version.
Detects potential exploitation of RustDesk remote access software, focusing on unauthorized process execution from RustDesk-related binaries (including session relay and rendezvous components) and the presence of documented proof-of-concept (PoC) artifacts associated with session permission bypass vulnerabilities.
Detects OpenVPN Connect spawning unexpected child processes such as command interpreters or scripting engines, which indicates potential exploitation of the echo-script arbitrary code execution vulnerability (CVE-2026-45115). This vulnerability allows attackers to push a malicious echo directive via the VPN server configuration that forces the client to execute arbitrary commands upon disconnection.
Detects the execution of known exploit harnesses and proof-of-concept scripts related to CVE-2026-55200, a critical pre-authentication heap out-of-bounds write vulnerability in libssh2. The rule monitors for the execution of binaries and Python scripts identified as part of the libpwn exploit toolkit used to trigger the vulnerability.
Detects the creation of shortcut (.lnk) files in the Windows Startup directory by common archive extraction utilities, indicative of the Gamaredon/UAC-0226 GIFTEDCROOK campaign using CVE-2025-8088 to perform path traversal and gain persistence.
Detects the spawning of common command-line or script execution shells (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe) by the Windows Remote Management (WinRM) provider host (wsmprovhost.exe). This behavior is often indicative of remote code execution or lateral movement via WinRM.
The rule detects the processes that are executed by the Moonrise malware, which is a backdoor used by the APT29 group.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
Detects the execution of known desktop hypervisor management CLI tools such as VBoxManage or vmrun to enumerate local virtual machines. Attackers may use these commands during the discovery phase to identify running virtual environments for evasion or subsequent actions.
Detects the execution of curl.exe to download an executable payload directly into the C:\ProgramData\ directory.
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
Detects the ClickFix kill chain where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command shell or utility (cmd.exe, powershell.exe, mshta.exe) to execute a download cradle or deploy known payloads like NetSupport RAT. This behavior is typically associated with malicious CAPTCHA prompts that deceive users into pasting and executing commands via the Windows Run dialog.
This rule detects scenarios where Microsoft Office applications (Word, Excel, Outlook, PowerPoint, OneNote) spawn known suspicious child processes (LOLBAS) that exhibit command-line flags indicative of remote content retrieval or script execution (e.g., download strings, encoded commands) and subsequently initiate network connections to public IP addresses or URLs within a 15-minute window.
Detects execution patterns associated with the DragonReturn loader, which implements a timing delay loop using GetTickCount64 before executing secondary actions, such as deploying a Windows service via sc.exe.
Detects the creation or modification of a .vscode/tasks.json file, followed by the execution of a process (specifically node.exe) that targets a script file without a standard JavaScript extension (.js, .mjs, .cjs). This behavior is consistent with an adversary configuring a hidden VS Code task (e.g., using 'hide:true' and 'runOn:folderOpen') to silently execute arbitrary code or assets when a project folder is opened.
Detects potential Millenium RAT activity where a process masquerading as a legitimate system file (e.g., svchost.exe or MsEdgeUpdate.exe) is executed from a non-standard directory and subsequently initiates network communication with the Telegram Bot API within a one-hour window. This behavior is indicative of malware beaconing and exfiltrating victim profiling data.
Identifies the loader cementing persistence by creating a scheduled task that executes the RMM payload upon user logon or system start. Specifically looks for 'schtasks.exe' creating a task with a name that is not alphanumeric and a task run command pointing to an executable in the AppData directory.
Detects the presence, file creation, or execution of known proof-of-concept (PoC) scripts, binaries, and directories associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability.
Detects persistence mechanisms associated with the UAC-0226 threat actor by identifying a LNK shortcut file located in the user Startup folder that executes a minimized cmd.exe process. This command shell subsequently launches a hidden PowerShell command that reads and executes code from C:\ProgramData\WC3 using Invoke-Expression (IEX). This activity is linked to the GIFTEDCROOK delivery chain.
Detects the use of native Windows administration utilities (vssadmin, wbadmin, bcdedit, wmic, powershell) to delete shadow copies, modify boot configurations to disable recovery, or remove backup catalogs, a behavior typically performed by ransomware groups like The Gentlemen to prevent system recovery.
Detects the execution of npm install commands that include known malicious package names associated with a supply chain attack linked to the Lazarus Group. These packages are designed to impersonate the legitimate 'rollup-plugin-polyfill-node' package.
Page 349 of 977