Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
This rule detects activities associated with the OceanLotus (APT32) supply-chain compromise, specifically targeting the SPECTRALVIPER loader chain. It identifies the masqueraded execution of 'IntelAudioService.exe' and specific sideloading carriers (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' flag, the loading of the 'DtlCrashCatch.dll' malicious module, and network beaconing to known APT32 C2 infrastructure.
Detects suspicious process execution patterns related to WindowsPackageManagerServer.exe and ConfigurationRemotingServer.exe, which can be abused for command execution or bypassing standard interaction via COM interfaces. This includes spawning the package manager server from unauthorized parent processes, the use of manual activation flags for COM abuse, and the spawning of shell or utility processes from the configuration remoting server.
Detects anomalous execution patterns of the Windows Package Manager (WinGet) DSC engine. It monitors for potential bypass of the standard winget.exe client by identifying direct calls to WindowsPackageManagerServer.exe with manual activation flags, unusual parentage of ConfigurationRemotingServer.exe, or usage of DSCourier-related binaries that interact with WinGet components, which may indicate unauthorized package installation or configuration management.
This rule detects potentially suspicious process creation or file modification activities associated with Autodesk applications or generic 'appcompat' paths. The detection logic flags processes executing with the '-uiDll' command-line argument and specific file operations (Creation/Modification) involving configuration or log files, often associated with unauthorized software tampering or suspicious binary execution patterns.
Detects suspicious PowerShell commands used to import certificates into the LocalMachine\Root store. This behavior is often associated with adversaries attempting to establish persistence by installing rogue root certificates to intercept or decrypt encrypted traffic (Man-in-the-Middle) or to bypass security controls. The rule flags instances where certificate installation is invoked by specific suspicious parent processes, utilizes known malicious certificate thumbprints, or explicitly targets the Root store.
Detects the creation of local user accounts or adding users to privileged groups triggered by ConfigurationRemotingServer.exe. This activity is indicative of potential misuse of the WinGet DSC (Desired State Configuration) capability to maintain persistence or escalate privileges on a Windows host, a technique observed in the DSCourier malware.
Detects the execution of schtasks.exe originating from Windows system management or package management server processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This activity may indicate administrative task automation or potentially malicious persistence and execution attempts using legitimate system binaries.
This rule detects the execution of account management commands such as user creation or group member modification initiated by or originating from 'ConfigurationRemotingServer.exe'. It also monitors for subsequent Windows Security Event IDs 4720 (User Account Created) and 4732 (Member added to local group) specifically targeting the 'Administrators' group, which indicates potential unauthorized administrative account or group membership manipulation.
This rule detects suspicious child process creation originating from 'setup.exe' (specifically with 'metakit' arguments) or 'IntelAudioService.exe' (specifically with sideloading-related arguments like '/appmodel', '/StateRepository', and '/Service'). These indicators are commonly associated with the SPECTRALVIPER threat activity, where legitimate-looking processes are abused to launch secondary, potentially malicious tools like cmd, powershell, or other system utilities.
This rule detects the execution of ConfigurationRemotingServer.exe when spawned by unexpected parent processes, such as winget.exe, WindowsPackageManagerServer.exe, or DSCourier.exe. These processes are associated with Desired State Configuration (DSC) and package management, and their use to launch ConfigurationRemotingServer.exe in certain contexts may indicate exploitation of DSC features to execute unauthorized configurations or commands.
Detects Gitea act_runner processes spawning Docker containers with dangerous configurations, such as privileged mode, host namespace mounts, or security-opt bypasses, followed by the execution of 'nsenter' or shell processes, which are indicative of a container escape attempt to the host.
Detects reconnaissance and exploitation setup activities associated with CVE-2026-46331 (pedit COW). The rule identifies processes enumerating kernel versions via system files or commands, checking unprivileged user namespace capabilities, and configuring network traffic control (tc) filters with pedit actions, which are critical precursors to leveraging the pedit page cache corruption vulnerability.
Detects suspicious system calls by unprivileged users involving unshare, IPsec XFRM policy configuration, and kernel module loading. This specific sequence is used in the DirtyClone (CVE-2026-43503) exploit, which leverages local IPsec tunnels to perform page-cache corruption and modify sensitive system binaries in memory.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
Detects the exploitation of the CVE-2025-8088 vulnerability in WinRAR, where a path traversal technique is used to extract malicious files directly into the Windows Startup folder. This pattern is associated with threat actors like Gamaredon to achieve persistence, typically by placing HTA downloaders that execute upon user logon.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
Detects malicious .jse loader scripts associated with Kimsuky's NUKESPED malware family. The rule identifies suspicious behaviors including the creation of Scripting.FileSystemObject for filesystem manipulation, use of GetSpecialFolder for staging, and file system enumeration via GetFile, which are key components of the threat's payload delivery and staging process.
Detects the deletion of executable or script files (e.g., .dll, .exe, .bat, .jse) from temporary directories using common command-line utilities like cmd.exe or scripting hosts. This behavior is often associated with malware (such as Kimsuky loaders or JFMBackdoor) attempting to remove dropped artifacts to evade forensic analysis.
Detects behavior indicative of the Kimsuky threat group's JSE loaders. The rule identifies two distinct phases: the use of 'Scripting.FileSystemObject' to write a PE executable to a temporary directory, and the subsequent silent execution of that file using 'WScript.Shell.Run' with a hidden window style. This is a common pattern for dropper activity originating from malicious JScript files.
Page 375 of 977