Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of Mimikatz specifically utilizing the lsadump::dcsync command or the internal DRSGetNCChanges function call. These behaviors are indicative of an adversary performing directory replication abuse against a Domain Controller to extract sensitive Active Directory credentials, including password hashes.
Detects the use of ADExplorer with the snapshot command to create Active Directory database snapshots, or the usage of 'net user' and 'net group' commands with the /domain argument. These techniques are commonly used by attackers to enumerate Active Directory users and groups to identify high-value targets within a domain.
Detects the hh.exe (HTML Help) process spawning wscript.exe. This behavior is a common indicator of a Compiled HTML (CHM) file executing an embedded malicious VBScript payload, often used for initial access or malware delivery.
Detects cmd.exe spawning powershell.exe with command-line arguments indicative of a reverse shell, specifically leveraging encoded commands or TCP socket objects. This pattern is characteristic of attackers injecting malicious keystrokes via the Remote Mouse Socket.IO service.
Detects instances where a web browser process (e.g., chrome.exe, msedge.exe) initiates a cmd.exe process with a command-line argument containing '/c'. This behavior often indicates a drive-by download or a malicious script execution triggered via a browser exploit or phishing activity.
Detects the execution of cmd.exe originating from the Remote Mouse or Peyara service process, correlating with an immediately preceding unauthenticated network connection on TCP port 1313. This behavior is indicative of exploitation of a remote service vulnerability, often associated with the Peyara Remote Mouse remote code execution exploit.
Detects the execution of .crx Edge extension files where the parent process is Microsoft Teams, often indicating social engineering attacks delivering malicious extensions.
Detects the execution of WScript.exe invoking discovery-related WMI objects or common system enumeration commands such as 'tasklist'. This activity is often associated with initial reconnaissance, environmental discovery, or script-based malware post-compromise.
Detects attempts to exploit the SystemInformer (formerly Process Hacker) service (phsvc) for local privilege escalation. The rule monitors for abnormal process spawning by rundll32.exe, the presence of specific PoC artifacts like 'phsvc_rundll_poc.dll', 'systeminformer_phsvc_poc.txt', or command-line arguments containing 'SYSTEMINFORMER_PHSVC_POC', and loading of DLLs from user-writable temporary directories.
Detects anomalous process execution chains originating from Gitea or Gitea Act Runner processes. This rule is designed to catch post-exploitation behavior associated with CVE-2026-20896, where an improperly configured reverse proxy allows an attacker to impersonate an administrator. The detection identifies shells, scripting interpreters, and network utilities spawned by the Gitea service, which may indicate command injection, malicious git hook execution, or CI/CD job abuse following an unauthorized administrative access.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
Detects the installation of a driver service using sc.exe from suspicious, non-standard directories (e.g., Temp, AppData) or involving common driver extensions (.sys). This behavior is indicative of the Bring Your Own Vulnerable Driver (BYOVD) technique, often used to load vulnerable drivers to bypass or disable security products, consistent with activities attributed to various threat actors.
This rule detects potentially malicious activity associated with the exploitation of CVE-2026-45115 in AnyDesk, including the creation of the 'adprinterpipe' named pipe, the spawning of suspicious elevated child processes (e.g., cmd.exe, powershell.exe) by AnyDesk processes, or the installation of services from an AnyDesk process context.
Detects ClickFix clipboard-paste payloads by identifying fake 'human verification' comments embedded in the command line of commonly abused Living Off the Land Binaries (LOLBINs). These comments are used by attackers to disguise malicious commands as CAPTCHA steps (e.g., reCAPTCHA, Cloudflare Turnstile, 'not a robot', verification-id, Ray ID). This rule is technique-level and not actor-specific, complementing the ErrTraffic rule.
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
Detects the use of the native Windows 'reg.exe' utility to export sensitive registry hives (SAM, SECURITY, SYSTEM) commonly targeted by adversaries for offline credential extraction.
Detects the execution of a process named 'fortiendpoint_patch.exe' located outside the authorized Fortinet program files directory, which is indicative of potential masquerading by an adversary attempting to hide malicious activity under a legitimate-sounding process name.
Detects behavior associated with the SnappyClient remote access trojan, specifically identifying the execution of 'VirtualAr.exe', which performs GDI-based screen capture and keyboard hooking via 'SetWindowsHookEx', followed by the staging of stolen data within the 'ProgramData\Mayanex\Nata' directory.
Detects the execution of PowerShell commands targeting a specific staging directory 'ProgramData\Zooms', typically associated with the ClickFix malware campaign. The rule flags processes invoking secondary payload retrieval via '.r2.dev' or 'dl-callback' patterns, which are indicative of staged second-stage download activities.
Detects evidence of process hollowing involving 'ServiceModelReg.exe', often used to conceal malicious stealer activity. The rule correlates the creation of this process with subsequent unexpected outbound network connections from the same process/host, and also monitors for specific debug/log strings indicative of failed or active process hollowing attempts (RUNPE techniques).
Page 355 of 977