Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of a malicious Node.js payload by the TONResolver malware. The rule monitors for the execution of node.exe from a specific path within the user's AppData directory (AppData\Local\Nodejs\node-v24.13.0-win-x64\) when accompanied by a JavaScript file argument, indicating the execution of a remote access trojan (RAT) script.
Detects the execution of 'whoami' via 'cmd.exe' where the parent process is not a standard Windows system process or a known application path. This pattern is often indicative of reconnaissance or post-exploitation activity where an attacker attempts to identify the current user context.
This rule detects potentially malicious command-line execution patterns aimed at harvesting sensitive credentials. It monitors for the access or searching of configuration files (e.g., AWS, .env, or Github tokens) and the dumping of environment variables that likely contain API keys or secrets, specifically targeting services like AWS, Anthropic, and GitHub.
Detects the use of .NET reflection within PowerShell to resolve and invoke native Windows APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx) typically used by the GIFTEDCROOK actor to perform in-memory shellcode or PE loading. The rule searches for command line patterns combining native API names with reflection-related keywords.
Detects the WinRAR.exe process creating a .lnk shortcut file within the user's Startup directory. This behavior is indicative of an exploitation attempt (e.g., UAC-0226 related NTFS path traversal vulnerabilities) where an attacker plants a persistence mechanism via a malicious archive extraction.
This rule detects potential credential harvesting activities by monitoring for suspicious environment variable enumeration or unauthorized access to sensitive credential and configuration files (such as AWS credentials and .env files) by common command-line utilities. It is designed to identify post-compromise reconnaissance where an adversary attempts to extract cloud provider or AI API keys.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
Detects the use of common archive utilities (7-Zip, WinRAR) to perform file archiving operations within sensitive user-profile directories (Desktop, Documents, Downloads, etc.). This pattern is often used by adversaries to stage or bundle sensitive data prior to exfiltration.
Detects instances where the Windows Installer (msiexec.exe) spawns a command prompt (cmd.exe) to execute specific batch files or custom scripts, which is a technique often used for malicious proxy execution.
Detects the execution of 7-Zip (7z.exe) when launched from a specific directory path ('Traiolx Custom Utils') while operating on specific files named 'drata.dat' or 'data.dat'. This behavior is indicative of an adversary staging or archiving sensitive data for potential exfiltration.
Detects the execution of Control Panel applets (.cpl) via unconventional proxy binaries like dllhost.exe or rundll32.exe. This pattern is commonly observed in malware attempting to execute malicious DLLs by leveraging Windows system binaries to bypass security controls and application whitelisting.
Detects instances where the 'pg_dump' database utility is executed, followed by the deletion of a file within a one-hour window by the same agent. This behavior is indicative of an attacker extracting sensitive database contents and subsequently attempting to remove evidence of the dump or staging files.
Detects Akira ransomware-associated PowerShell script execution that attempts to terminate backup, virtualization, and database services (such as VMware, Veeam, Hyper-V, and MSSQL) and inhibit system recovery by deleting Volume Shadow Copies or disabling boot recovery features.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
Detects ClickFix-style attacks where users are social-engineered into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The rule specifically monitors for powershell.exe being initiated by explorer.exe with command-line arguments involving clipboard access (Get-Clipboard) or web-based script retrieval/execution (iwr, iex).
Detects suspicious process activity, module loading, and function calls indicative of the BeepRAT malware family. The rule monitors for keyboard hooking via SetWindowsHookEx, the presence of specific keylogger-related command-line arguments, and the execution or loading of files associated with BeepRAT lure binaries.
Detects the execution of 'aws sts get-caller-identity' combined with 'curl' operations utilizing stdin data piping, often associated with unauthorized identity enumeration and data exfiltration in cloud-native environments, particularly when initiated from developer tool contexts like Amazon Q/MCP configurations.
Detects the execution of AWS CLI commands typically used for cloud resource enumeration (e.g., listing users, roles, buckets, or identity information) when spawned by common development environments, IDEs, or shell interpreters. This rule is designed to identify potential post-exploitation activity where an attacker uses compromised developer credentials or environments to map the cloud infrastructure.
Detects the execution of known MyBB 'Limited ACP to Admin' proof-of-concept scripts via common python interpreters and identifies suspicious child process spawning behavior from typical web server applications (such as nginx, apache2, and php-fpm). This activity is indicative of post-exploitation attempts or web shell execution via injected plugins or templates.
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
Detects potential container escape attempts via 'docker cp' path traversal attacks or suspicious shell execution spawned from the Docker daemon. The rule monitors for directory traversal sequences in 'docker cp' commands, the use of PoC tooling strings, file modifications outside expected container paths, and shell process spawning originating from Docker-related parent processes.
Page 370 of 977