Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where the FortiTray.exe process is launched by the FortiClient scheduler (scheduler.exe). This pattern is typical of standard FortiClient operation, but can be used as a baseline for monitoring application behavior.
Detects multiple signals associated with potential process injection or hollowing involving 'ServiceModelReg.exe'. The rule correlates process creation in a suspended state, memory injection-related actions, outbound network connections from the process, and specific debug strings often associated with automated process hollowing tools.
Detects instances where the FortiTray.exe process, associated with Fortinet client software, initiates a command shell (cmd.exe) with suspicious command-line arguments. This pattern is often indicative of potential process injection, command hijacking, or illegitimate execution triggered by the FortiTray binary.
Detects instances where the OpenVPN Connect client (OpenVPNConnect.exe or openvpn.exe) spawns unexpected child processes, such as cmd.exe, powershell.exe, or wscript.exe. This behavior is associated with the exploitation of server-pushed echo-scripts, which can lead to arbitrary code execution on the client system.
Detects malicious PowerShell command-line execution associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's Ptero-family of tools. This rule flags PowerShell processes utilizing encoded commands (-enc, -EncodedCommand), hidden windows (-nop, -w hidden), and downloader cmdlets (DownloadString, DownloadFile, IEX) that include specific strings linked to the Ptero malware suite (e.g., PteroPaste, PteroVDoor, PteroPSDoor).
Detects the use of .NET reflection within PowerShell to access the 'AmsiUtils' class and set the 'amsiInitFailed' field to true. This technique effectively disables the Antimalware Scan Interface (AMSI) for the current PowerShell process, allowing subsequent malicious code or scripts to execute without being scanned for threats.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell script via PowerShell, typically executed via IEX (Invoke-Expression) to load the payload directly into memory, which is a common post-exploitation technique often performed following an AMSI bypass.
Detects instances where the Claude Code AI agent or its subprocesses are used to establish persistence. This is achieved by monitoring for crontab modifications or direct writes to SSH authorized_keys files, which are common indicators of post-exploitation activity following an Axiom-style indirect prompt injection.
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) directly by known AI agent developer binaries (e.g., claude, cursor, aider) or indirectly via command shells spawned by these agents. This behavior may indicate an AI agent being leveraged to establish persistence or automate malicious actions on a host.
Detects the execution of wscript.exe with the //b and //e:vbscript flags, forcing the Windows Script Host to interpret a file as VBScript regardless of its file extension. This technique is used to bypass extension-based security controls, with documented use by the Kimsuky threat group.
Detects a PowerShell download cradle that retrieves a payload archive from a Cloudflare R2 bucket (pub-*.r2.dev/*.zip) and reports success via an out-of-band HTTP GET to a /dl-callback/ endpoint containing a GUID, consistent with ClickFix loader behavior.
Detects the use of native Windows utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, disable system recovery, or remove backup catalogs, which are common actions taken by ransomware to inhibit system recovery.
Detects a multi-stage execution chain associated with the 'Contagious Interview' campaign, where Visual Studio Code (Code.exe) spawns a shell process (cmd, powershell, bash, or sh) that uses network retrieval utilities (curl, wget, or http) to download content from known Lazarus group staging domains within a two-minute window.
Detects persistence mechanisms frequently associated with SharkLoader and Cobalt Strike. The rule monitors for scheduled task creation using specific suspicious naming patterns, tasks pointing to SystemSettings.exe in non-standard directories (AppData/ProgramData), high-frequency task triggers, and registry run key modifications targeting SystemSettings.exe in similar suspicious paths.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Detects instances where explorer.exe (acting as a parent process due to a user executing commands via the Win+R Run dialog) spawns common command-line interpreters or script hosts (powershell.exe, cmd.exe, mshta.exe, wscript.exe) with suspicious command-line arguments indicative of malicious activity, such as encoded commands, downloader patterns, or file execution proxies. This pattern is consistent with ClickFix-style social engineering attacks where users are tricked into copying and pasting malicious payloads from a webpage into the Run dialog.
Detects rapid execution of multiple network reconnaissance commands on a single host. Adversaries often use these built-in utilities (e.g., ipconfig, net, arp) to map an environment's network configuration, users, shares, and service structure after initial compromise to inform subsequent lateral movement.
Detects the execution of PowerShell with hidden window styles originating from a shortcut (.lnk) file. This behavior is commonly associated with malicious LNK files masquerading as PDF documents, often used as an initial access vector to launch stage-one payloads from temporary directories.
Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.
Detects instances where common web browsers initiate secondary processes such as command-line interpreters (cmd.exe, powershell.exe) or scripting engines (wscript.exe, cscript.exe, mshta.exe). This pattern is frequently indicative of drive-by download attacks or initial access where an adversary uses web browser activity to execute malicious scripts or commands.
Detects the execution of cmdkey.exe with the /list flag, which is used to enumerate credentials stored in the Windows Credential Manager. This technique is often used by adversaries for post-compromise reconnaissance to identify stored credentials for lateral movement.
Page 356 of 977