Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects anomalous activities associated with the CitrixBleed2 campaign where the ScreenConnect remote access tool is used to deploy or execute QEMU virtual machine artifacts. The rule monitors for the spawning of virtualization binaries (e.g., qemu-system-x86_64) via the ScreenConnect service, the dropping of QEMU-related files into ScreenConnect directories, and the suspicious creation of local administrator accounts (CtxAppVCOMService).
This rule monitors for potential C2 communications and tunneling activity associated with the STAC4713 campaign. It detects outgoing network connections to known malicious IP addresses, traffic over specific non-standard ports used for tunneling, or the execution of QEMU (qemu-system-x86_64.exe), which is often used by this threat actor to host malicious services or tunnels. The rule includes logic to suppress benign, internal-only QEMU activity.
Detects potential supply-chain attack activity related to IronWorm, including modifications to the AppInit_DLLs registry key and the execution of Windows utility binaries (regsvcs.exe, regasm.exe, InstallUtil.exe) by npm or node processes, which are commonly abused to facilitate malicious code execution during package installation.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects suspicious behavior originating from Windows Package Manager (winget.exe) and associated DSC/Server processes. This rule identifies two specific patterns: 1) These processes spawning shells or interpreters (e.g., PowerShell, cmd, mshta) which may indicate command-line abuse or malicious script execution. 2) These processes making outbound network connections to non-private/external IP addresses, potentially indicating remote payload delivery or command and control activity.
This rule detects command-line activity and process execution associated with the exploitation of various Linux kernel vulnerabilities, including CVE-2026-43503, CVE-2026-46300, CVE-2026-43284, CVE-2026-31431, and CVE-2026-43500. It monitors for the compilation and execution of exploit code, manipulation of kernel modules via modprobe for specific network protocols (esp4, esp6, rxrpc), configuration changes to network namespaces (xfrm, unshare), and the presence of known exploit filenames like DirtyClone or DirtyFrag.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to locate and modify the internal 'amsiInitFailed' or 's_amsiInitFailed' fields within the AmsiUtils class. This technique prevents PowerShell from correctly identifying or blocking malicious scripts by forcing the AMSI initialization status to a state indicating a failure has already occurred, effectively disabling the security engine for that session.
This rule detects potentially malicious command execution patterns where shell interpreters (bash, sh, zsh, dash) are invoked to process data piped from suspicious sources. This includes patterns like piping DNS query output (dig) directly into a shell—a technique often used in C2 communication—and base64-encoded payloads executed by shells that originate from or are associated with AI agent tooling (e.g., Claude, Cursor, Cody, Copilot). This behavior is indicative of unauthorized code execution or command and control activity.
Detects suspicious command-line patterns on Linux systems commonly associated with post-exploitation activity, including the establishment of reverse shells, encoded payload delivery via DNS, and manual modifications to crontab or SSH authorized_keys for persistence.
Detects remote code execution exploitation targeting CVE-2026-20253 in Splunk. The rule monitors for unauthorized child processes, such as shells or scripting interpreters, being spawned by the Splunk daemon (splunkd). It also flags processes containing exploit-related strings in the command line as a secondary indicator.
This rule detects processes on Linux systems that masquerade as kernel worker threads (kworker). Legitimate kworker processes are kernel threads initiated by the kernel with no on-disk file path (or a bracketed path). The rule flags processes that have an actual file system path associated with them and are not spawned by the kernel thread manager (kthreadd), indicating potential malicious masquerading.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
Detects the execution of Node.js where the command line arguments reference a .woff2 font file. This behavior is indicative of an adversary attempting to execute a malicious payload disguised as a legitimate font file, a technique previously associated with the PolinRider campaign.
Detects the execution of command-line utilities (cmd.exe, powershell.exe, wscript.exe, curl.exe) when launched directly from a web browser or associated web-related processes (e.g., chrome.exe, msedge.exe). This pattern is often indicative of drive-by downloads or malicious web content attempting to execute code on the endpoint.
This rule detects the use of 'sc.exe' to interact with services related to 'Mixed Reality' (a potential name masquerading technique) where the parent process is not the standard 'services.exe' or 'svchost.exe'. The rule also correlates this activity with the invocation of command interpreters like 'cmd.exe' or 'conhost.exe' by the parent process, which is highly indicative of malicious service manipulation or lateral movement.
This rule detects potentially malicious activity where a web browser (e.g., Chrome, Edge, Firefox) spawns suspicious child processes (e.g., mshta.exe, wscript.exe) with command-line arguments that include indicators of script execution, remote code download, or command invocation, which is a common pattern in drive-by download attacks and malicious link execution.
Detects the execution of 'PerfWatson2.exe' when initiated from the user-writable 'AppData\Local' directory. 'PerfWatson2.exe' is a legitimate Windows process associated with the Windows Error Reporting service; its presence or execution from a user directory is indicative of masquerading or potential malware activity.
This rule detects suspicious activity involving the BITSAdmin (bitsadmin.exe) utility, which is a known LOLBin (Living Off the Land Binary). It monitors for the creation of BITS jobs using suspicious flags (e.g., /transfer, /setnotifycmdline) potentially indicating external file downloads, as well as the execution of known command interpreters or utilities spawned as child processes by BITSAdmin, which is a common post-exploitation technique for persistence or secondary payload execution.
Detects techniques used by adversaries to hide files, directories, or modify access permissions on Windows systems. This includes the use of 'attrib.exe' to set the hidden attribute, PowerShell cmdlets to set file attributes, 'icacls' to modify or deny permissions, and the creation of hidden Unix-style dot-prefixed files within common Windows user directories.
Detects a suspicious execution chain associated with LegionLoader where msiexec.exe triggers cmd.exe, which subsequently invokes 7-Zip (7z.exe or 7za.exe) to extract payloads into the AppData\Roaming directory. This pattern is characteristic of LegionLoader's staging phase.
Detects the creation of Windows scheduled tasks using 'schtasks.exe' where the executable being registered or the task itself is associated with suspicious directories like %LOCALAPPDATA%, %APPDATA%, or %TEMP%. The rule further filters for specific suspicious strings often used in malicious task configurations, indicating potential persistence or malicious command execution.
Page 352 of 977