Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects suspicious process executions containing specific obfuscated strings or unique identifiers ('phuditimmer', 'instuite25', 'instuite43', 'instuite67') often associated with malicious tools or downloader activity.
Detects the 'codesign' utility being invoked with flags '-fs' (force sign) and '--deep' (recursively sign) triggered by a shell process spawned from 'Script Editor'. This pattern is often used to bypass macOS Gatekeeper or attempt to re-sign malicious applications after tampering.
Detects the execution of AppleScript files named 'Maccy.scpt' using the 'osascript' or 'Script Editor' utilities. The rule correlates this process execution with network activity directed towards the 'maccyapp.com' domain within a one-hour window, identifying potential unauthorized or malicious scripting behavior involving Maccy-related artifacts.
Detects the use of 'codesign' by 'Script Editor' on macOS to sign files within the '/Library/Application Support/' directory. This behavior is indicative of potential malicious activity, such as attempting to bypass Gatekeeper or signing tampered application files to maintain persistence or evade security controls.
Detects execution of processes named 'Finder' or 'Software Update' that originate from within the '/Library/Application Support/' directory on macOS. This pattern is indicative of potential masquerading where malicious binaries or persistent payloads are placed in shared application support folders to mimic legitimate system components.
Detects the execution of common archival utilities (7zip, WinRAR) with command-line arguments specifying password protection. Attackers often use these utilities to compress and encrypt data prior to exfiltration to evade detection and prevent unauthorized access to sensitive files.
Detects the short-lived execution of an AppleScript file named 'Maccy.scpt' using the Script Editor application. This pattern of execution, characterized by very brief process lifetimes, is often associated with automated tasks or potential abuse of AppleScript for command execution.
Detects the execution of processes that display a fake password prompt masquerading as system utilities like Maccy or Finder. This behavior is indicative of credential phishing or a social engineering attempt to steal user credentials by prompting for a password under the guise of a system update or configuration change.
This rule detects command-line execution or activity containing specific strings associated with a fake 'damaged application' dialog box on macOS. This behavior is indicative of the PamStealer malware or similar social engineering campaigns that attempt to deceive users into believing their application is corrupt, thereby tricking them into interacting with malicious artifacts.
Detects the use of reg.exe to save the HKLM\SAM registry hive to a file path outside of standard system directories. This behavior is indicative of credential dumping attempts, where adversaries attempt to bypass endpoint security behavioral detection rules that monitor for SAM file access in common locations by using alternative, potentially allowlisted paths.
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Unrestricted) originating from the ScreenConnect SystemTemp directory. This behavior is consistent with malicious campaigns, such as those deploying AsyncRAT via trojanized installers, that utilize the ScreenConnect temporary storage path to stage and execute secondary malicious payloads.
Detects the execution of specific suspicious processes (Mixed Reality.exe, COU_ITR-1_to_4_AY2026-27.exe) or svchost.exe processes spawned from Windows Media Player paths, followed by suspicious loading of amsi.dll. This behavior is associated with the DragonReturn DLL sideloading and evasion chain.
Detects the use of the Windows service control utility (sc.exe) to install or manage a malicious service named 'MixedSvc'. This activity, which involves pointing the service executable to 'Mixed Reality.exe' located in the Windows Media Player directory, is a persistence technique observed in Operation DragonReturn attributed to the Silver Fox threat group.
This rule detects potential exploitation of vulnerabilities (such as CVE-2026-33017) where mshta.exe or wscript.exe spawns PowerShell, followed by the addition of a persistent entry to the HKCU Run registry key targeting Node.js or JavaScript files.
Detects the execution of curl.exe to download an executable payload directly into the C:\ProgramData\ directory.
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
Detects indicators of persistence on Linux systems, specifically targeting unauthorized cron job creation/deletion in /etc/cron.d/, execution of suspicious shell scripts (ssync.sh), modification of startup scripts (e.g., /etc/rc.d/cron), and execution of binaries from world-writable directories by cron or system daemons. This rule is designed to identify the footprint of known Linux-based persistence mechanisms associated with service account exploitation.
Detects the spawning of conhost.exe as a child process of wermgr.exe, an anomalous behavior indicative of the RoguePlanet exploit chain (CVE-2026-50656) which uses a Defender quarantine pipeline junction hijack to replace the legitimate Windows Error Reporting manager. Standard operations of the legitimate wermgr.exe process do not involve launching interactive console hosts.
Detects the Yuta .NET WPF dropper (SLaunch.exe) executing and subsequently creating a secondary payload (winupdate.exe) within the AppData\Roaming\.cache directory. This pattern is characteristic of the Yuta/Glove Stealer infection chain where a dropper masquerading as a UI component stages a PyInstaller-compiled stealer binary.
Detects the creation of suspicious scheduled tasks by potentially malicious processes (e.g., winupdate.exe or processes running from AppData/.cache or Temp directories). The rule monitors for schtasks.exe usage that either targets specific persistence locations or creates tasks naming conventions (e.g., 'WindowsDefenderAgent') often associated with the Yuta/Glove Stealer malware family.
Detects the execution of known malware families (Atlas RAT, RomulusLoader, SilentRunLoader) or processes spawned from temporary directories (AppData/Local/Temp, AppData/Roaming/Temp, Windows/Temp) by common email clients, browsers, and file archivers. This behavior is indicative of a user-initiated execution of a malicious payload, typically associated with phishing or drive-by download attacks.
Detects malicious persistence mechanisms using the Windows Task Scheduler, specifically targeting the creation or execution of 'TPMProfiler' or 'qemu-system-x86_64.exe' under high-privilege accounts (SYSTEM). This rule monitors for schtasks.exe task creation, anomalous parent-child process relationships involving task host processes, and unauthorized module loads of taskschd.dll associated with QEMU activity.
Page 357 of 977