Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects unauthorized execution of wermgr.exe from suspicious paths or spawned by Task Scheduler service (svchost.exe/taskeng.exe) with non-standard parent processes. This behavior is indicative of privilege escalation attempts where an unprivileged process leverages the Windows Error Reporting (WER) QueueReporting scheduled task to execute a malicious payload in the context of the SYSTEM account.
Detects anomalous instances of conhost.exe running with SYSTEM integrity within an interactive user logon session. This behavior is indicative of session hijacking techniques, such as those leveraging named pipes or LaunchConsoleInSessionId, used to force console hosts into user-controlled sessions to potentially capture input or manipulate processes.
Detects the execution of command lines containing suspicious keywords associated with potential data encryption, database table destruction, or configuration tampering. These commands, such as those invoking encryption functions or dropping configuration tables, are indicative of malicious activity often performed by ransomware or wiper malware to hinder system recovery or exfiltrate and destroy data.
Detects a sequence of events on a single host within a 10-minute window involving both the deletion of Volume Shadow Copies (using vssadmin.exe or wmic.exe) and the execution of ESXi management commands (using esxcli or vmware binaries). This behavioral pattern is often indicative of ransomware attempting to inhibit system recovery and interfere with virtualized infrastructure components concurrently.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, services, or processes. This includes the use of Set-MpPreference to change configuration, service control (sc) to stop the WinDefend service, process termination via taskkill, or the execution of known removal scripts like DisableDefender.ps1.
Detects the invocation of script interpreters (python, bash, powershell, etc.) initiated by package management utilities (pip, npm, gem). This pattern is often indicative of supply chain attacks, automated malicious script delivery, or post-exploitation activity where legitimate development tools are abused to execute encoded or obfuscated commands.
Detects the creation of a Windows service named 'RageService' using the sc.exe utility, potentially involving associated binary names like 'RageCore_' or 'win_guard_'. This activity is indicative of persistence mechanisms used by malware or unauthorized tools.
Detects the use of bcdedit.exe to disable automatic Windows recovery or suppress boot failure notifications. Adversaries often perform this action during the impact phase of an attack to prevent system restoration after data destruction or ransomware encryption.
Detects the use of taskkill.exe with the force flag (/f) to terminate critical system processes like explorer.exe, or common security and administrative tools such as task manager, registry editor, process hacker, or antivirus software. This activity is often associated with malicious actors attempting to impair security controls or evade detection.
Detects the autonomous execution of package manager commands (pip, npm, yarn) initiated by processes associated with AI agent pipelines, automation scripts, or CI/CD runners. This behavior is indicative of potential malicious activity where automated agents may be tricked into installing hallucinated or malicious packages from untrusted domains without human oversight.
Detects instances where common package management utilities (pip, npm, wget, curl) establish network connections to domains outside of verified official package registry endpoints. This pattern is often used in software supply chain attacks to retrieve malicious packages from attacker-controlled infrastructure.
Detects the execution of known network exploitation tools like Responder.py or MultiRelay.py, as well as unauthorized processes binding to ports used for LLMNR (UDP 5355) and NBT-NS (UDP 137), which are classic indicators of potential adversary-in-the-middle attacks.
Rule for T1548.002 technique "Bypass UAC using Event Viewer (cmd)"
Detects post-compromise persistence techniques, including crontab modifications, SSH authorized_keys updates, and systemd service creation, when performed by child processes of AI agentic tools like Claude, Node.js, or Python. This activity suggests malicious persistence establishment following an indirect prompt injection or supply-chain compromise of the AI agent environment.
Detects AI agent processes (e.g., claude, node) executing environment enumeration commands (env, printenv) following suspected prompt injection, combined with subsequent network traffic associated with credential exfiltration patterns.
This rule monitors for indicators of process hollowing or memory injection targeting ServiceModelReg.exe. It correlates suspicious events including the creation of suspended processes, memory writes, remote thread creation, specific debug strings (e.g., RUNPE, PEB patched), and outbound network connections. This approach aims to reduce noise from legitimate use of ServiceModelReg.exe by requiring multiple indicators of malicious behavior.
Detects the execution or presence of the EKZ Stealer binary by its known SHA-256 hash. EKZ Stealer is an infostealer malware that utilizes techniques like control-flow flattening and opaque predicates to evade static analysis and decompilation.
Detects the execution of encoded PowerShell commands initiated by a .cmd script associated with a FortiClient VPN configuration. This activity is indicative of the FortiBleed post-exploitation chain, where an attacker injects malicious PowerShell into VPN configuration scripts via a compromised FortiClient EMS admin API.
Detects the execution of 'client32.exe', which is the executable for NetSupport Manager remote control software, when it is located outside of its standard installation directory. This can be indicative of a portable or unauthorized remote access tool being deployed by an adversary for persistence or command-and-control.
Detects indicators of a malicious driver or associated activity named 'pcdhost.sys'. The rule monitors for the installation of this driver via 'sc.exe', registry modifications related to this filename, the creation of this file on disk, and specific suspicious process command-line artifacts ('AtLorenBase', 'MANPO: ReadModule', 'PERS: FAIL', 'RUNPE:', 'POST: hollow=') typically associated with malware or offensive toolkits.
This rule detects the execution of the 'FortiEndpoint_Patch.exe' binary when command-line arguments typically used for status queries, data retrieval, or export tasks (such as 'list', 'search', 'view', or 'export') are passed to it. This monitoring identifies potential reconnaissance or information gathering activities performed by an attacker interacting with Fortinet endpoint management utilities.
Page 350 of 977