Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects various methods used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials. It monitors for suspicious Process Access (EventCode 10) with sensitive access masks, as well as Process Creation (EventCode 1) and Image Load (EventCode 7) events associated with known credential dumping tools like Mimikatz and legitimate system tools misused for dumping memory such as Procdump and comsvcs.dll.
This rule detects the execution of tools associated with HTTP/2 upgrade queue poisoning proof-of-concept (PoC) code or anomalous process-level interactions involving nghttpx. It tracks specific command-line strings, file operations, and unauthorized spawned sub-processes originating from nghttpx, which could indicate attempts to exploit request smuggling vulnerabilities in HTTP/2 implementations.
Detects indicators of the SystemInformer PHSVC (Process Hacker Service) local privilege escalation proof-of-concept. The rule monitors for the loading of the PoC DLL by rundll32, the execution of commands containing specific PoC strings, and the spawning of shell processes by PHSVC-related parent processes.
Detects instances where AI coding assistants (e.g., Claude Code, Cursor, Windsurf) spawn shell interpreters or scripting runtimes that subsequently initiate outbound network connections to non-private IP addresses. This behavior is indicative of potential malicious activity, such as credential theft or workspace trust bypass exploits (e.g., CVE-2026-12957), where an attacker leverages an AI coding assistant to execute arbitrary code. The rule excludes common build and test runner processes to minimize false positives.
Detects anomalous child process execution spawned by ImageMagick binaries. This pattern aligns with exploitation of ImageMagick vulnerabilities where Ghostscript delegates are hijacked via search order manipulation (PATH or working directory) to achieve arbitrary code execution.
Detects high-risk child processes spawned by 7-Zip (7z.exe, 7zG.exe, 7zFM.exe) when extracting files. This rule is designed to identify potential exploitation of CVE-2026-46331, where 7-Zip fails to properly propagate the Zone.Identifier alternate data stream (Mark-of-the-Web) from RAR5 archives, effectively bypassing SmartScreen security warnings for extracted executables or scripts.
Detects anomalous child process execution spawned by Lunar Client or associated Java runtime processes, typically stemming from a malicious Modrinth modpack. This exploit path leverages Electron framework vulnerabilities to execute arbitrary system binaries (e.g., cmd.exe, powershell.exe, explorer.exe) via shell commands triggered by modpack installation or execution.
This rule detects the creation of suspicious scheduled tasks using either the schtasks command or through the system's scheduled task service. It focuses on task actions originating from suspicious parent processes (such as browsers or script interpreters), tasks executing scripts from writable user directories, or tasks with persistence triggers (e.g., /SC MINUTE, /SC ONLOGON) containing encoded PowerShell commands or hidden window styles indicative of malicious activity.
This rule detects activities associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the loading of known vulnerable drivers, the installation or configuration of drivers via system services, and the execution of tools known to facilitate driver-based kernel manipulation.
Detects execution of processes by masqueraded lure executables associated with Mustang Panda campaign themes (e.g., India-Taiwan relations, hydropower projects) spawning known LOLBins like rundll32.exe, regsvr32.exe, or PowerShell, indicating potential side-loading or malicious loader activity.
Detects the spawning of a Python interpreter process by npm or node.js parent processes where the Python command line involves directories typically used for temporary files or staging (e.g., AppData, Temp). This behavior is consistent with the execution of the InvisibleFerret multi-stage backdoor, often delivered via malicious packages in developer environments.
Detects spearphishing activity involving project-related lure archives, subsequent file drops of potentially malicious DLLs and executables (sideloading indicators), and the execution of processes masquerading as the lure documents.
Detects potential data exfiltration by monitoring interpreter processes (Python, Node.js) that access sensitive local credential/configuration files and subsequently connect to known cloud storage or code repository APIs (Dropbox, GitHub, Google Cloud). The rule correlates file access events with network connection activity.
This rule detects potential developer workstation compromise by monitoring for suspicious child process creation (shells/interpreters) from common development tools (Code.exe, node.exe, python.exe) followed by subsequent authentication to cloud environments (Azure, AWS, or GCP) within a 60-minute window. This behavior is indicative of a developer's machine being compromised to harvest session tokens or credentials to access cloud resources.
Detects potential identity pivoting by correlating signs of developer workstation compromise (e.g., shell spawning from IDE/node processes) with subsequent anomalous cloud console or API access from the same or associated identity within a short timeframe. This rule monitors both Azure Sign-in logs and AWS CloudTrail activity for suspicious patterns following endpoint indicators.
Detects instances where the Visual Studio Code process (code.exe) spawns shell or scripting interpreters (such as cmd.exe, powershell.exe, python.exe, etc.) to execute commands involving sensitive file paths, development configuration files, or suspicious keywords, specifically within a short duration (5 minutes) after Git or NPM activity has occurred on the same host. This pattern may indicate exploitation or unauthorized code execution triggered through a compromised or malicious development environment.
Detects the use of rundll32.exe to process files with common image extensions (.jpg, .jpeg, .png, .bmp, .gif). This behavior is often associated with steganography or attempts to disguise malicious payloads by masquerading them as image files.
Detects Microsoft Office applications spawning suspicious child processes (e.g., cmd.exe, rundll32.exe) or initiating network connections to WebDAV paths, which may indicate exploitation of ActiveX OLE auto-execution vulnerabilities.
Detects network connections over port 3389 (RDP) initiated by processes other than standard Remote Desktop clients (mstsc.exe). This rule specifically looks for suspicious indicators such as execution from non-standard or temporary file paths, or the use of common living-off-the-land binaries (like powershell.exe, cmd.exe, rundll32.exe) that might be acting as a proxy for remote access or lateral movement.
Detects the execution of known Kerberoasting tools or commands that indicate an attempt to request Kerberos service tickets for offline cracking. This activity is a core component of the Kerberoasting attack technique.
Detects the execution of common Windows utilities (diskpart, format, cipher, sdelete, eraser) when used with flags indicative of data destruction or disk wiping behavior. This rule monitors for process creations involving commands designed to irrecoverably erase data or wipe drive contents.
Page 371 of 977