Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where the Windows COM Surrogate process (dllhost.exe) is executed with a command line argument referencing a .cpl (Control Panel) file. This behavior is indicative of an attempt to proxy malicious code execution via the Control Panel utility, a technique often used to evade application allowlisting.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
This rule detects potential unauthorized remote access activity by correlating the execution or network activity of known remote access tools (Tailscale) or suspicious network patterns (DuckDNS, port 4444) with the subsequent execution or network activity of secondary RAT/remote desktop software (RustDesk, AnyDesk, TeamViewer) on the same host within a 10-minute window. This behavior is indicative of an adversary establishing an initial C2 connection followed by deploying secondary remote access tools for persistent remote control.
Detects anomalous SSH daemon (sshd) activity characterized by the installation or execution of a non-standard sshd binary (often located in /tmp or /var/tmp) or the execution of sshd with suspicious command-line arguments (custom ports or custom configuration files), followed by modifications to the authorized_keys file. This behavior is indicative of unauthorized persistence or backdoor access.
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
Detects the use of dsquery.exe to enumerate users in Active Directory. This command-line utility is often used by attackers for reconnaissance to gather information about domain users.
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
This rule detects suspicious command-line activity by looking for the presence of keywords such as 'risk', 'threat', or 'exposure' in process creation command lines (Event ID 4688). It then aggregates these events by computer and account over one-hour intervals and flags if 3 or more such activities occur within that hour, indicating potential reconnaissance or malicious activity.
Detects suspicious use of winget.exe and its associated COM API components (ConfigurationRemotingServer.exe and WindowsPackageManagerServer.exe). The rule monitors for unauthorized child process spawning (e.g., cmd.exe, powershell.exe) by the package manager, execution of manual configuration activation via COM, and use of winget to pull external YAML configurations or non-standard file types, which may indicate software supply chain compromise or abuse of system management tools for payload delivery.
This rule detects the execution of PowerShell commands and scripts known to be used for Kerberoasting, a technique for obtaining TGS tickets that can be cracked offline to recover service account passwords. The rule matches specific tool names and command line flags associated with common offensive security tools.
Detects instances where ConfigurationRemotingServer.exe spawns known living-off-the-land binaries (LOLBINs) or executes binaries from suspicious paths. This behavior is indicative of abuse of the WinGet DSC WindowsProcess resource block to execute arbitrary commands.
Detects potentially malicious use of the Windows Package Manager (WinGet) to configure system environments, specifically targeting flags that bypass user interactivity or agreements, as well as the spawning of the ConfigurationRemotingServer by WinGet or related package management processes, which could indicate the deployment of unauthorized or malicious configurations.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
Detects AI coding extensions (e.g., Cursor, Windsurf, Claude) spawning Node.js or Python child processes to execute potential Model Context Protocol (MCP) server configurations located in non-standard, potentially untrusted workspace paths. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-12957, where adversaries leverage MCP to gain unauthorized command execution.
Detects Lunar Client spawning suspicious child processes or command lines, which is characteristic of exploit chains like 'lunar-modrinth-chain-poc'. These attacks typically leverage renderer vulnerabilities to execute shell commands, .lnk files, or arbitrary binaries via abused APIs like shell.openExternal or malicious modpack overrides.
Detects anomalous child process creation, suspicious command-line arguments, or the presence of specific file artifacts associated with the exploitation of heap corruption vulnerabilities in FFmpeg RASC/DLTA codecs (as demonstrated by the exploitarium FFmpeg-RASC-DLTA-calc-poc PoC).
Detects unauthorized or malicious shell command execution spawned by the Amazon Q Developer VS Code extension, originating from a workspace-defined MCP (Model Context Protocol) server configuration file (.amazonq/mcp.json or .vscode/mcp.json) as associated with the CVE-2026-12957 vulnerability.
Detects the use of the Tiny C Compiler (tcc.exe) with command-line arguments to compile and execute shellcode from a 'config.ini.c' file located in the %LOCALAPPDATA%\TCC directory. This technique is specifically associated with BeepRAT to execute code directly in memory while attempting to evade security controls like AMSI, ETW, and WLDP.
Detects suspicious child processes spawned by AI-powered IDE assistants (e.g., Amazon Q, Claude Code, Cursor) that perform AWS credential inspection combined with network exfiltration commands. This activity is indicative of exploitation of IDE extension vulnerabilities (e.g., CVE-2026-12957) where malicious configuration files force the IDE to spawn shell processes to steal and transmit cloud environment credentials.
Detects the spawning of potential Model Context Protocol (MCP) server processes immediately following or by package installation commands (npm, pip). This behavior is characteristic of malicious packages or typosquatted dependencies attempting to register or execute a malicious MCP server configuration upon installation in a developer environment.
Detects anomalous child process execution from PHP web handler processes (e.g., php-fpm, php-cgi) indicative of exploitation of the StreamBucket SOAP RCE vulnerability. The rule identifies spawning of common shell tools or access to sensitive process memory files (/proc/self/maps or /proc/self/mem) associated with ASLR defeat techniques used in this exploit chain.
Page 359 of 977