Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of 'i.bat' script accompanied by subsequent commands intended to exhaustively impair security defenses on a Windows host. The rule identifies the combination of the script execution and targeted commands to disable Microsoft Defender, stop Sysmon/Filebeat services, and uninstall or misconfigure ModSecurity modules.
Detects the execution of known Active Directory enumeration tools (BloodHound/SharpHound, AdFind) and command-line techniques (net group /domain, PowerView cmdlets) that are frequently associated with reconnaissance activities by threat actors like Akira affiliates, particularly when initiated from non-standard or unmanaged endpoints.
Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.
Detects the execution of common reconnaissance or command-line utilities (e.g., whoami, net, powershell, cmd) spawned by the IIS worker process (w3wp.exe). This pattern is a strong indicator of post-exploitation activity or web shell usage on a compromised web server.
Detects the execution of RDP files (mstsc.exe) initiated by common application vectors (email clients, browsers, archive utilities) from suspicious user-writable paths like Temp, Downloads, or AppData directories. This behavior is consistent with Turla group's phishing delivery chain where malicious RDP files are used for persistence or lateral movement.
Detects mshta.exe spawning from archive utilities (winrar.exe, 7z.exe) or Windows Explorer, or executing HTA files directly from common user-writable temporary or download directories. This pattern is commonly associated with the execution of malicious payloads delivered via compressed archives, a technique observed in campaigns attributed to the Turla threat group.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
Detects the use of conhost.exe with the --headless flag to execute Node.js payloads silently. This technique is used by EtherRAT to run its malicious JavaScript payloads without displaying a console window to the user, aiding in defense evasion.
Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.
Detects the use of PowerShell to perform system reconnaissance commands and exfiltrate the collected data using HTTP POST requests (curl or Invoke-WebRequest). This behavior is often associated with post-compromise activity and is flagged with higher severity when initiated from an IIS worker process or when using encoded PowerShell arguments.
Detects unauthorized executables masquerading as XDR agents (Palo Alto Networks) or VMware tools (XDRAgent.exe, vmtools.exe, vmwared.exe) by executing from suspicious directories such as AppData, Temp, or ProgramData\VMware instead of authorized installation paths. This technique is often used to hide the execution of malicious tools like reverse tunnel clients or VPN utilities.
Detects the initialization of unprivileged user and network namespaces combined with specific IPsec tunnel configurations (xfrm/esp/veth). This sequence of operations is a known prerequisite for exploiting the DirtyClone (CVE-2026-43503) vulnerability, a Local Privilege Escalation (LPE) in the Linux kernel.
Detects indicators of SSH-based lateral movement and credential access, including suspicious SSH command-line flags (e.g., BatchMode, StrictHostKeyChecking), manual enumeration of SSH keys via ssh-add, inspection of agent socket variables, and unauthorized access to critical SSH configuration and identity files by non-standard processes.
Detects the use of the 'net.exe' or 'net1.exe' utilities with the 'group' and '/domain' arguments, indicating an attempt to query domain-level groups. This technique is commonly used by attackers during the discovery phase to map out domain security groups.
Detects the execution of common command-line utilities (net.exe, dsquery.exe, AdFind.exe) used to query Active Directory for user information. This pattern is characteristic of adversary discovery activities targeting domain user accounts and group memberships. The rule filters out processes launched by Microsoft-signed binaries to reduce noise.
Detects Python processes spawned from development tools (Node.js, VS Code, Cursor) that perform suspicious file access to browser credential stores (e.g., Login Data, cookies.sqlite) and subsequently initiate significant outbound network POST requests, characteristic of browser-based credential harvesting and exfiltration.
This rule detects the use of the native Windows 'tar.exe' utility to extract a ZIP archive into an AppData staging path. This behavior is associated with the Potemkin Loader, which downloads a ZIP payload and then silently extracts it. The rule specifically looks for 'tar.exe' being executed with the command-line arguments '-xf' followed by a ZIP file and '-C' followed by a path containing 'AppData'.
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Detects the execution of known Millenium RAT masqueraded binaries (svchost.exe or MsEdgeUpdate.exe) from AppData directories, followed immediately by a PowerShell command to add the root drive C:\ to Windows Defender exclusions. This sequence indicates a malware stage where a RAT attempts to persist and avoid detection by modifying security tool configurations.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding an exclusion path. This activity is commonly used by adversaries to prevent security software from scanning specific directories where malicious tools or payloads are staged.
Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.
Page 380 of 977