Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of mimikatz.exe or the usage of the sekurlsa::logonpasswords command, both of which are indicative of attempts to extract sensitive credentials from LSASS memory.
Detects instances where PowerShell is spawned by cmd.exe and includes command-line arguments indicative of a reverse shell, such as network socket creation, hidden execution, or encoded commands. This pattern often follows suspicious parent processes or activities such as keystroke injection.
Detects the modification of Windows Registry 'Run' keys using the command-line utility 'reg.exe'. This technique is commonly employed by adversaries to establish persistence, ensuring that malicious code, such as the MiniJunk backdoor, executes automatically upon system login.
Detects the execution of the Windows HTML Help executable (hh.exe) to open a Compiled HTML Help (.chm) file. The rule specifically monitors for known indicators associated with Kimsuky, including the 'Review.chm' lure name and a specific file hash identified in threat intelligence reporting as part of a multi-stage attack involving decoy content.
Detects the use of 'docker cp' to copy files out of a container to the host filesystem. This rule identifies suspicious patterns that may exploit the path traversal vulnerability CVE-2026-43503, which allows an attacker to escape the intended destination directory on the host.
Detects the execution of wscript.exe as a child process of hh.exe (the Microsoft HTML Help executable). This behavior is often associated with the execution of malicious scripts embedded within CHM files, which is a common technique for bypassing security controls and executing arbitrary code.
Detects instances where the WinRAR archive utility spawns a PowerShell process with command-line arguments typically associated with obfuscated or fileless execution. The detection specifically flags PowerShell commands that employ techniques such as base64 encoding, execution policy bypass, hidden window styles, or commands containing indicators of in-memory process manipulation such as NtAllocateVirtualMemory or memory allocation constants.
Detects the use of PowerShell to read files from the C:\ProgramData directory using the -Raw parameter, followed by the execution of the content via Invoke-Expression (iex). This pattern is often used to execute obfuscated payloads stored in non-standard locations while bypassing basic execution constraints.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects execution of persistence-related commands such as cron job modifications or SSH key additions originating from development-related parent processes or installation commands like npm/pip. This behavior is indicative of potential supply chain compromises or malicious actors abusing development environments to maintain access.
Detects the use of the Microsoft IIS administrative tool, appcmd.exe, to uninstall ModSecurity WAF modules. This activity is a known technique used by adversaries to impair security defenses during post-exploitation, specifically observed in campaigns targeting ColdFusion servers.
Detects suspicious child processes spawned by AI coding agents that are potentially indicative of an indirect prompt injection attack. The rule specifically looks for the execution of 'axiom init' or 'pip install' commands, which are often used by attackers to execute malicious code within an environment when tricked by instructions embedded in repository files.
Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.
Detects web browsers or file explorer spawning common script interpreters (PowerShell, CMD, mshta, etc.) with command-line arguments indicative of malicious activity, such as encoded commands, Base64 strings, or web-based script downloads, typical of ClickFix or similar browser-based social engineering attacks.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
This rule detects executions of 'winscp.exe' that are spawned by suspicious parent processes commonly associated with web servers or command interpreters (e.g., w3wp.exe, httpd.exe, powershell.exe). It also flags instances where WinSCP is invoked with command-line arguments indicative of automated scripts, custom configuration files, or remote transfer protocols (SFTP/SCP/FTP), which may indicate data staging or exfiltration activities.
This rule detects attempts to clear Windows Event Logs using either 'wevtutil.exe', PowerShell 'Clear-EventLog' command, or by monitoring specific Windows Event IDs (1102 and 104) which indicate logs have been cleared. Clearing event logs is a common technique used by attackers to hide malicious activity and evade detection.
Detects WinRAR creating .lnk files within Windows Startup directories under suspicious conditions. The rule looks for indicators of NTFS Alternate Data Stream (ADS) path traversal, where WinRAR might be instructed to write a file into a sensitive directory using a path like 'archive.rar:stream\malicious.lnk'. This behavior is indicative of exploitation attempts related to vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
This rule detects the creation, modification, or startup of virtual machines using common administrative tools such as PowerShell (Hyper-V), vmrun (VMware), VBoxManage (VirtualBox), and vSphere CLI tools. Such activities can be indicators of adversary efforts to create hidden virtual environments, stage malicious payloads, or perform unauthorized administrative actions on virtualized infrastructure.
Detects the use of the IIS command-line utility (appcmd.exe) to disable HTTP logging for an IIS site. Attackers may disable logging to conceal post-exploitation activities or unauthorized access attempts from forensic analysis and security monitoring.
Detects reconnaissance activity targeting Active Directory infrastructure using common discovery tools such as AdFind, BloodHound/SharpHound, dsquery, nltest, and native net commands. The rule identifies suspicious patterns by correlating multiple executions or flagging the use of known adversarial enumeration binaries, monitoring for commands that specifically target domain domain-wide information, trust relationships, or domain groups.
Page 379 of 977