Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects anomalous behavior associated with the 'tcc.exe' executable, which is often leveraged by the BeepRAT loader for malicious operations. The rule monitors for suspicious process start flags ('-nostdlib', '-run'), execution from unconventional locations (outside of standard Program Files), the spawning of common shell processes (cmd.exe, powershell.exe, etc.), and unsolicited outbound network connectivity. This rule effectively flags potential loaders or backdoor activity originating from this binary.
Detects registry enumeration activities targeting HKLM software keys related to Windows versioning and system configuration. This pattern is characteristic of BeepRAT post-compromise reconnaissance, where an adversary attempts to gather system information to profile the environment.
This rule detects two suspicious behaviors associated with the TinyRCT malware family: the execution of common installer or archiver utilities in the Downloads folder that terminate within two seconds, and the use of 'choice.exe' for self-deletion of an executing process within a short timeframe.
Detects the execution of the Windows command shell (cmd.exe) originating from either Windows Explorer or the RemoteMouse application. This activity often indicates an attempt to gain manual command-line interaction with the system, potentially through a malicious file execution, social engineering, or exploitation of the RemoteMouse application.
Detects MCP (Model Context Protocol) server processes or developer tools spawned by IDE extensions performing environment variable enumeration to access cloud credentials (e.g., AWS, Azure, GCP, GitHub tokens) followed by anomalous outbound network connections, indicating potential exfiltration of sensitive developer environment secrets.
Detects the use of the 'docker cp' command with suspicious path traversal characters or known PoC artifacts in the destination parameter. This behavior is indicative of an attempt to exploit path traversal vulnerabilities in the Docker daemon (such as those allowing container escape) by writing files outside the container's intended scope onto the host filesystem.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
This rule detects potential persistence mechanisms on Windows systems by monitoring for the creation or modification of registry run keys, the use of 'reg.exe' to add entries to run keys, and the creation of shortcut files (.lnk) in the Windows Startup directory.
Detects the creation of unrecognized Go-compiled binaries by common developer tools (e.g., node.exe, code.exe) in user-writable or temporary directories, followed shortly by outbound network connections to known C2 infrastructure (e.g., vercel.app, jsonkeeper.com). This behavior is consistent with the 'Contagious Interview' campaign attributed to the Lazarus Group.
Detects the modification of the EnableLUA registry key via the reg.exe utility. Setting EnableLUA to 0 effectively disables Windows User Account Control (UAC), which is a common post-exploitation technique used to elevate privileges or bypass security prompts.
Process Data as source
File running from Recycle Bin
File running from Recycle Bin
Detects evidence of exploitation attempts related to the hypothetical CVE-2026-55200 vulnerability. The rule monitors for known exploit file names, command-line arguments, and specific network patterns targeting SSH ports (22, 2222) that indicate potential LibSSH2 exploitation.
Detects exploitation attempts against the Flowise Model Context Protocol (MCP) environment, specifically targeting the node_options case-sensitivity bypass (CVE-2026-20182). The rule monitors for malicious node child process spawning, command line injection via the --require flag, suspicious file creation (flowise_marker.txt), and unauthorized outbound network connections from the Flowise process.
Detects the execution of 'net.exe' from a 'powershell.exe' parent process to either reset the local administrator password or reactivate a built-in domain administrator account. This behavior is associated with the Akira ransomware group's pre-encryption stage to ensure access to compromised endpoints.
Detects indicators of the DirtyClone (CVE-2026-43503) Linux kernel local privilege escalation exploit. The rule identifies the execution or compilation of the PoC binary, the specific su invocation used for shell spawning by the exploit, and subsequent post-exploitation actions including modifying sensitive files (/etc/passwd, /etc/sudoers) and creating new local accounts with sudo privileges.
Detects the creation or registration of virtual machines across multiple hypervisor platforms (Hyper-V, VMware ESXi, and VirtualBox) using PowerShell, command-line utilities, or security event logs. The rule alerts on these actions when performed outside of designated business hours or by accounts not included in a pre-defined list of authorized administrators.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, services, or processes. This includes the use of Set-MpPreference to change configuration, service control (sc) to stop the WinDefend service, process termination via taskkill, or the execution of known removal scripts like DisableDefender.ps1.
Detects the execution of potential malware disguised as 'winupdate.exe' and specific network traffic associated with it. The rule identifies suspicious file paths (e.g., in AppData cache) and execution by the binary while communicating with external domains such as pastebin.com or discord.com, which are often abused for command-and-control or payload delivery.
This rule detects the execution of processes named 'RoguePlanet.exe' and monitors for inter-process communication using named pipes with the same name. This pattern is indicative of a specific malware payload attempting to establish communication channels for C2 or process interaction.
Detects execution of wermgr.exe from suspicious, non-standard directories (such as temp or user-writable paths). This behavior is indicative of the 'RoguePlanet' exploit, which leverages a junction swap to replace the legitimate Windows Error Reporting binary with a malicious payload, executed via the WER QueueReporting scheduled task.
Detects the Yuta/Glove stealer malware performing sandbox and virtualization environment evasion. The rule specifically monitors for the process 'winupdate.exe' attempting to query common registry keys associated with virtualization software (VMware, VirtualBox, VBOX, QEMU) and executing WMI commands to enumerate system manufacturer information via 'wmic.exe'. These actions are commonly used by malware to detect if it is executing within an analysis sandbox or VM to abort or alter its behavior.
Page 351 of 977