Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where a Node.js or NPM process spawns the systemd-userdbd utility. This behavior is highly irregular in standard Linux environments and may indicate an attempt to interact with system user databases, potentially for privilege escalation, persistence, or credential discovery by an application running in the Node.js runtime.
Detects the execution of command shells (cmd, powershell, pwsh) spawned by the Remcos Remote Access Trojan (RAT), typically located in ProgramData or executing as remcos.exe. The rule monitors for command-line arguments indicative of script execution.
Detects potential UAC bypass or COM hijacking activities by monitoring for anomalous process spawning patterns from Windows auto-elevating binaries (e.g., eventvwr.exe, fodhelper.exe, sdclt.exe) or suspicious child processes spawned by DllHost.exe from user-writable directories.
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
Detects suspicious child processes (such as shell interpreters or downloader tools) spawned by Langflow, uvicorn, or python processes. The rule focuses on common indicators of post-exploitation activity, including code execution via python arguments, use of curl/wget to pull payloads, and execution of shell scripts often associated with malware droppers.
This rule detects potential exploitation of an out-of-bounds write vulnerability in Python's Pillow library (ImageCms module). It identifies Python processes initialized with indicators related to known exploit research (exploitarium) that subsequently terminate with error signals indicative of a crash, such as heap-buffer-overflows or memory management errors, suggesting successful or attempted exploitation.
Detects the execution of Python-based proof-of-concept scripts related to the Pillow ImageCms out-of-bounds write vulnerability. The rule monitors for Python process execution involving specific file paths associated with the PoC, and correlates this with subsequent process crashes or abort signals which are indicative of an exploit attempt resulting in process instability.
Detects the creation or execution of executable files from within %APPDATA%\Local\Temp subdirectories starting with '100000', a path pattern frequently associated with the distribution and staging of infostealer malware such as RedLine and Lumma.
Detects the execution of the 'curl' utility with parameters configured to interact with an SMTP server using 'EXPN' or 'VRFY' commands while loading a configuration file via the '-K' flag. This pattern is indicative of an attempt to exploit CVEs or software vulnerabilities that are susceptible to CRLF injection within SMTP recipient fields, potentially leading to unauthorized mail relaying or protocol manipulation.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects the execution of MAVInject.exe (Microsoft Application Virtualization Injector) with the /INJECTRUNNING parameter, a technique used to inject malicious code into a running process to evade detection.
Detects the execution of processes or command lines containing strings associated with known malicious tools or malware, specifically: BlueHammer, RedSun, UnDefend, and Bluekit.
This rule detects the presence and execution of files associated with the proof-of-concept (PoC) exploit for CVE-2026-55200, a remote code execution vulnerability in libssh2. The rule monitors for specific exploit binary names and directory structures commonly used by security researchers or attackers to test or exploit this vulnerability.
Detects the use of WScript.exe to execute non-script extensions (e.g., .ini, .dat, .txt) as VBScript. Adversaries often use this technique to bypass file extension restrictions or execute obfuscated payloads by forcing a non-executable file type to be parsed by the Windows Scripting Host.
Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.
This rule detects the execution of a process named 'sightgrab.exe' or the creation of suspicious JPG files within the 'C:\Users\Public\Videos\' directory. This activity is indicative of credential or data harvesting tools, often used to capture screenshots or sensitive user data, followed by staging the captured files in public-accessible folders.
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
Page 378 of 977