Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the abuse of msiexec.exe to execute malicious payloads, a technique observed in the StrikeShark campaign. The rule identifies suspicious child processes, installation from remote sources (UNC/HTTP), execution from non-standard user-writable directories (Temp, AppData), and the use of quiet installation flags to mask malicious activity.
Detects rapid Socket.IO 'key' event traffic directed at the unauthenticated Remote Mouse service (TCP 1313) followed by the spawning of command shell processes (cmd.exe, powershell.exe) on the same host. This pattern aligns with the Metasploit Remote Mouse RCE module, where an attacker simulates keystrokes to execute arbitrary commands.
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window style, or specific payload strings like 'MiniJunk') originating from common file staging directories (e.g., Downloads, Temp, AppData). This pattern is often indicative of malicious post-lure payload execution.
Detects scenarios where an executable (.exe) or installer (.msi) is launched from a staging or temporary directory (e.g., Temp, Downloads) and subsequently deleted within 5 minutes. This behavior is indicative of malware or adversary tools cleaning up their own footprints after execution.
This rule detects the creation of a scheduled task via schtasks.exe using parameters often associated with malicious persistence mechanisms, such as running as SYSTEM, requiring highest privileges, or placing task actions in directories like Temp, AppData, or Public. This behavior is consistent with tactics used by various threat actors, including UNC1549/MiniJunk, to maintain persistence.
Detects the execution of wscript.exe or cscript.exe which are commonly used to execute VBScript files for performing host reconnaissance tasks such as process enumeration via WMI and file system discovery using Scripting.FileSystemObject.
Hunting rule for T1197 "Bitsadmin Download (cmd)". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1197 "Bitsadmin Download (cmd)". No public in-the-wild intel reference available; correlate before alerting.
Detects instances where WinRAR.exe is observed writing potentially malicious script or link files (.hta, .vbs, .js, .ps1, .lnk) into the Windows Startup folder. This pattern is indicative of exploitation of CVE-2025-8088, a path traversal vulnerability in WinRAR often leveraged by the Gamaredon group to establish persistence.
This rule detects 'git clone' operations on Windows systems that are correlated with the creation of or access to specific Amazon Q or VSCode Model Context Protocol (MCP) configuration files ('mcp.json'). The rule identifies potential unauthorized project cloning or reconnaissance activity involving developer tools.
Detects the execution of multiple system discovery utilities (systeminfo, wmic, ipconfig, net, arp, tasklist) originating from non-standard or suspicious directories (such as temp, appdata, or user directories). This behavior is often indicative of an adversary performing automated reconnaissance or discovery after gaining initial access.
Detects the execution of wmic.exe with command-line arguments related to hardware enumeration (e.g., system, BIOS, memory, video controller information) which are commonly used by malware for sandbox evasion and VM fingerprinting. The rule specifically alerts when these commands are spawned by processes running from suspicious temporary directories or staging paths often associated with malware droppers.
Detects a suspicious sequence of events involving the creation of an .amazonq/mcp.json file shortly after a git clone operation, followed by an AI coding assistant (Amazon Q, VS Code, Cursor, Windsurf) spawning runtime interpreters (node, npx, python). This behavior aligns with potential exploitation attempts against AI-assisted development environments, such as CVE-2026-12957, where malicious configuration files are used to trigger unauthorized code execution.
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
This rule detects potential TaskWeaver malware loader activity by monitoring for suspicious process execution patterns within a SimpleHelp Remote Monitoring and Management (RMM) context. Specifically, it triggers when a SimpleHelp process launches common scripting interpreters (wscript.exe, cscript.exe, node.exe, powershell.exe, cmd.exe) or when a file named 'jquery.js', a known lure filename used by TaskWeaver, is executed.
Detects the AnyDesk service-side printer worker process spawning suspicious child processes (e.g., cmd.exe, powershell.exe). This activity is indicative of exploitation attempts against CVE-2026-43503, where an attacker leverages the 'adprinterpipe' named pipe to send malicious COM marshaling bytes and impersonate the LocalSystem identity to escalate privileges.
Detects execution of Node.js processes associated with the TaskWeaver JavaScript loader. The rule monitors for unauthorized Node.js processes (lacking official publisher signatures) spawning secondary processes or executing specific suspicious command lines linked to TaskWeaver and Djinn Stealer activity, such as loading obfuscated jquery.js or accessing configuration files associated with credential theft.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by utilizing .NET reflection and IL generation. This technique involves creating dynamic methods and emitting instructions to manipulate the memory space of AmsiUtils, effectively disabling or blinding AMSI during script execution.
This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.
Detects the execution of Node.js-based JavaScript payloads (notably 'jquery.js') delivered via Remote Monitoring and Management (RMM) sessions, specifically SimpleHelp. The rule monitors for file creation of the payload in sensitive locations, the execution of the payload by Node.js, and subsequent post-exploitation discovery commands executed by the Node.js process.
Page 363 of 977