Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of a potentially malicious fltMC.exe from the user's TEMP directory, a technique utilized by the Red Lamassu actor to sideload the JFMBackdoor. This rule monitors for known malicious file hashes or the execution of fltMC.exe from suspicious locations where the legitimate System32 binary should not reside.
Detects outbound network connections to Fastly CDN IP ranges originating from suspicious file paths (Temp or ProgramData) or common LOLBins (wscript.exe, powershell.exe) often utilized by the Kimsuky threat group for NUKESPED backdoor C2 communication.
Detects the execution of known Living-off-the-Land (LotL) binaries (e.g., powershell.exe, certutil.exe, mshta.exe) where the parent or initiating process is the Windows Subsystem for Linux (WSL2) wsl.exe binary. This pattern indicates potential abuse of WSL2 interop features to execute Windows-native binaries from a Linux environment, often used to bypass traditional host-based monitoring or security controls.
Detects the use of the 'net.exe' or 'net1.exe' command-line utilities to mount a local SMB share using loopback addresses (127.0.0.1 or localhost) with the '/tcpport' argument. This pattern is indicative of attempts to exploit CVE-2026-24294 to bypass NTLM authentication protections through local reflection or relay attacks.
Detects the execution of short-named executable binaries from common staging directories (Users\Public, Windows\Temp, ProgramData) where the parent process is DllHost.exe, explorer.exe, or cmd.exe. This pattern is indicative of WSL2 being used to stage and execute payloads, where DllHost.exe is leveraged to proxy file operations from the WSL2 environment to the Windows host, potentially bypassing certain security controls.
Detects a suspicious sequence of events where a file with an architecture-specific name (often associated with botnet payloads like JDY/KV-botnet) is created, executed, and deleted within a 60-second window. This behavior is indicative of transient malicious payloads executing and self-removing to evade detection.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
This rule detects instances where rundll32.exe is spawned from scripting engines (wscript.exe, cscript.exe, powershell.exe, pwsh.exe) or executes from non-standard directories like AppData\Local\Temp or ProgramData. This behavior is commonly indicative of malicious proxy execution to bypass security controls.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects the execution of net.exe or net1.exe with the 'tcpport' argument, which is typically used for querying network port connectivity or information on a host.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
This rule detects the use of 'net.exe' or 'net1.exe' to configure a non-standard SMB port, which is a technique often used for NTLM reflection and relay attacks. By specifying an arbitrary port for SMB traffic, an attacker may attempt to bypass standard network filtering or establish a listener to intercept authentication requests.
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
Detects the execution of manage-bde.exe with command-line arguments designed to enable encryption, disable/delete BitLocker protectors, or modify authentication keys. This pattern is indicative of ransomware abuse, specifically actors attempting to encrypt drives and destroy recovery capabilities, particularly when spawned from scripting or shell environments like PowerShell, CMD, or WMI.
Detects behaviors associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the dropping of .sys driver files into non-canonical directories, the registration and execution of kernel services via sc.exe, the use of fltMC to load filter drivers, and the loading of driver modules from non-standard locations.
Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.
Detects execution of rundll32.exe from suspicious directories, such as user profiles, temporary folders, or ProgramData, or the usage of script protocol handlers like javascript: or vbscript:. This pattern is commonly used by adversaries to proxy execution of malicious code, bypass security controls, and execute scripts via a signed system binary.
This rule monitors for potential abuse of the Microsoft Management Console (mmc.exe) to proxy malicious activity. It detects three primary behaviors: 1) mmc.exe being launched with a .msc file originating from user-writable or suspicious directories; 2) mmc.exe spawning known suspicious child processes (e.g., powershell.exe, cmd.exe, rundll32.exe); and 3) the creation or modification of .msc files in suspicious locations by processes other than mmc.exe or msiexec.exe.
Detects potential dynamic linker hijacking on Linux systems by monitoring for the use of non-standard LD_PRELOAD paths in process command lines or unauthorized modifications to the /etc/ld.so.preload configuration file, which can be used to inject malicious code into processes.
Detects the use of package management tools (pip, npm, yarn) to install packages when initiated by common scripting interpreters or shells (python, cmd, powershell) in environments likely associated with CI/CD pipelines or automated workflows. The rule intentionally excludes jupyter and ipython interactive environments, suggesting it targets non-interactive or automated deployments.
Detects two distinct malicious PowerShell behaviors: memory-resident script execution using Base64 and XOR obfuscation, and unauthorized modification of Windows Defender preferences to add exclusions.
Page 376 of 977