Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
This rule detects post-exploitation activity related to the exploitation of PHP StreamBucket SOAP deserialization vulnerabilities. It monitors for child process execution from PHP web server processes (e.g., php-fpm, php.exe), the creation of specific proof-of-concept (PoC) marker files, and the presence of identified exploit script filenames on disk.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Detects arbitrary code execution attempts against Ghidra 12.1.2 by monitoring for suspicious child process spawning from the Ghidra JVM. The rule identifies instances where java.exe, running in a Ghidra-related context, launches unauthorized binary interpreters or tools such as powershell.exe, cmd.exe, or other shell utilities often used as post-exploitation payloads.
Detects anomalous activity consistent with the Velvet Ant 'Operation Highland' methodology, which leverages Nginx/FastCGI to bridge external requests to internal SSH execution. The rule monitors three conditions: 1) HTTP POST requests to internal endpoints containing SSH-related command parameters; 2) suspicious Nginx configuration modifications or reload events; and 3) spawning of SSH processes by FastCGI handlers. Findings are correlated by time and entity to identify potential persistence or lateral movement mechanisms.
Detects instances where the Windows Subsystem for Linux (WSL) processes (wsl.exe or wslhost.exe) are spawned by suspicious parent processes, which may indicate an attempt to use WSL for payload execution or persistence on hosts where its usage is restricted or not authorized.
Detects the use of the 'net.exe' or 'net1.exe' command-line utilities to mount a local SMB share using loopback addresses (127.0.0.1 or localhost) with the '/tcpport' argument. This pattern is indicative of attempts to exploit CVE-2026-24294 to bypass NTLM authentication protections through local reflection or relay attacks.
Detects wscript or cscript executing shell commands (del/delete) to remove .jse files. This pattern is commonly associated with malicious scripts attempting to clean up traces of their execution after running from temporary locations.
This rule detects attempts to disable Microsoft Defender security features or create exclusions via Windows Registry modifications or PowerShell cmdlets. It identifies tampering with Registry keys related to disabling AntiSpyware, behavior monitoring, or real-time protection, as well as the execution of PowerShell commands that adjust Defender preferences, such as disabling real-time monitoring or adding wide-scope file exclusions.
Detects host reconnaissance and file discovery activities indicative of the MINIRECON implant, a tool linked to Mustang Panda campaigns. The rule monitors for the execution of common system enumeration and file searching commands triggered by the 'pct12bmp.exe' process, or in unauthorized contexts.
Detects reconnaissance and enumeration activities targeting Active Directory Web Services (ADWS) on port 9389. This includes specific detection of the SharpADWS tool and anomalous processes that connect to ADWS, a technique used to bypass standard LDAP monitoring by encapsulating AD queries within SOAP messages.
This rule detects Go-compiled backdoor binaries executing from suspicious, non-standard directories (e.g., ProgramData, AppData, Temp, Public) and initiating cmd.exe or powershell.exe for command execution. This behavior is consistent with the deployment and operational tactics of The Gentlemen RaaS group's custom Go-based malware.
Detects instances where VS Code (Code.exe) spawns interpreter processes (node, python, cmd, powershell, sh, bash) after opening a workspace containing a suspicious tasks.json file. This pattern is consistent with the abuse of VS Code task automation features to gain initial code execution, similar to campaigns targeting developers through malicious repository cloning.
Detects anomalous Python activity indicative of the InvisibleFerret backdoor, specifically focusing on instances where Python processes are spawned by developer tools (node.exe, code.exe, cursor.exe), access sensitive credential/wallet files, or initiate outbound network connections on common C2 ports.
Detects Python interpreters launched by development tools (like VS Code or Node) that execute commands containing obfuscated code, base64-encoded strings, or strings indicative of credential harvesting and clipboard interaction, which may indicate malicious activity or post-exploitation behavior.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects the abuse of the CertUtil.exe Windows utility to download, decode, encode, or split files. This behavior is considered suspicious when initiated by common command-line shells or Office applications, which are frequently used as entry points for malicious scripts or macro-based attacks.
Detects the execution of PsExec (psexec.exe or psexesvc.exe) where the binary is not digitally signed by Microsoft Corporation. This is often an indicator of renamed or tampered versions of the tool used for lateral movement or remote command execution.
Detects potential Server-Side Template Injection (SSTI) attacks targeting the Flocci API Gateway using Velocity Template Language (VTL). The rule monitors for malicious VTL patterns in network traffic, subsequent OS command execution, anomalous file creation indicating RCE, and IAM scope bypass patterns in cloud environment logs.
Detects post-exploitation activity related to CVE-2026-55200 (libssh2 heap OOB write), specifically identifying when curl, git, or php processes spawn interactive shells or attempt to access sensitive processes like lsass.exe, indicating a successful exploit chain.
Detects the attempt to install new skills for AI agents using the "npx skills" command.
Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
Analysts should review any installed skills to verify their legitimacy.
Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
Analysts should review any installed skills to verify their legitimacy.
Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
Page 360 of 977