Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects web server processes (e.g., PHP, IIS, Apache, Nginx) spawning suspicious child processes including shells (cmd.exe, powershell, bash) or network utilities (curl, wget, netcat), which is often indicative of webshell exploitation or post-compromise activity.
Detects the execution of unauthorized processes or file modifications associated with the 'OpenVPN Connect echo script' vulnerability (ACE). This rule specifically identifies process creation events involving command-line arguments that attempt to trigger script execution on VPN disconnect, even when the software's script permission setting is disabled.
Detects anomalous Firefox behavior consistent with CVE-2026-20253 exploitation, including unauthorized modification of Smart Window browser preferences (e.g., enabling the feature or redirecting the API endpoint) and suspicious child process creation following potential URL exfiltration events.
This rule detects activity associated with the SHARDLOADER malware loader. It monitors for the presence of specific DLL files ('SolidPDFCreator.dll' or 'MediumInstStart.exe') in process image paths or process names, and explicitly checks for the creation of a unique mutex artifact named 'uydgcfteionxcfd' as a high-confidence indicator of execution.
Detects bulk file permission changes using native Windows utilities like icacls, cacls, or takeown. The rule flags instances where non-Microsoft signed processes execute these commands repeatedly (more than 5 times) within a short window, which is often indicative of automated privilege escalation or an attempt to weaken file access controls across a system.
This rule detects activities associated with domain enumeration and discovery. It monitors for the execution of known offensive tools like SharpADWS, network scanners, and specific PowerShell/command-line operations that query Active Directory groups and computers. Additionally, it identifies unauthorized network connections to the Active Directory Web Services (ADWS) port 9389, which can indicate an attacker attempting to interact with the domain environment directly from a compromised host.
This rule detects the execution of common enumeration commands (net, dsquery) on systems identified as Domain Controllers. These commands are frequently used by adversaries for reconnaissance to identify local or domain users and groups after gaining access to a host.
Detects suspicious process execution patterns where VS Code (code.exe) spawns interpreter processes (node.exe, python.exe) followed by network connections to known staging infrastructure (e.g., jsonkeeper.com, vercel.app). This behavior is characteristic of the 'Contagious Interview' campaign attributed to the Lazarus Group, used to deploy BeaverTail and InvisibleFerret malware following social engineering lures.
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
This rule detects when package management tools like npm or go get spawn suspicious child processes, such as interpreters (python, powershell, cmd, bash) or utility binaries (mshta, wscript), during the installation lifecycle. This behavior is indicative of malicious code execution triggered by compromised or hijacked software packages.
This rule detects the execution of specific malicious npm packages (jsonwebauth, fake-font) and associated script files (lserver.js, errorHandler.js) linked to Lazarus Group activity. It monitors node.exe processes for suspicious command lines, child processes originating from associated directories, and npm installation activities involving these packages.
This rule detects a multi-stage activity chain where a user performs a git clone, followed by Visual Studio Code, Node, or Python spawning a shell or interpreter, which then initiates a network connection to known suspicious staging infrastructure. This behavior is indicative of a developer machine being compromised to exfiltrate code or download malicious payloads.
Detects the use of 'attrib.exe' to modify file attributes (specifically adding hidden or system attributes) on files with a '.dll' extension located in suspicious directories such as 'ProgramData', 'AppData', or other paths frequently used for persistence or file staging. This behavior is indicative of an adversary attempting to hide malicious artifacts.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects indicators of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks or suspicious kernel driver installations. The rule monitors for known vulnerable driver files being written to disk, unauthorized creation of .sys files in temporary directories, the installation of new kernel driver services via System Event ID 7045 (referencing temp paths or known malicious drivers), and the use of the sc.exe utility to create services with a kernel driver type.
Detects the execution of known system binary names (e.g., svchost.exe, MsEdgeUpdate.exe) from suspicious locations within the user AppData directory rather than the standard Windows System32 directory. This behavior is a common indicator of malware persistence, masquerading, or defensive evasion.
Detects the execution of command-line shells (powershell.exe or cmd.exe) spawned by processes that are typically associated with system services or security products (e.g., svchost.exe, MsEdgeUpdate.exe), where the parent process is not located in the standard Windows System32 directory. This pattern often indicates attempts to bypass security controls or masquerading by malicious actors to achieve code execution.
Detects the execution of the 'whoami' command via cmd.exe initiated with High integrity. This behavior is often associated with discovery efforts by adversaries operating with elevated privileges to identify the current user context.
Detects evidence of PPID spoofing associated with the StrikeShark/Cobalt Strike framework. The detection identifies suspicious child processes (e.g., cmd.exe, powershell.exe) originating from common system processes (e.g., explorer.exe, svchost.exe) while the actual ancestor is a malicious SystemSettings.exe binary located in non-standard AppData paths. It correlates these process events with account mismatches between the spoofed parent and child process, indicating CreateProcessWithTokenW usage for token impersonation.
This rule detects scenarios where common web browsers (Firefox, Chrome, Edge, IE) launch Windows scripting hosts (wscript.exe or cscript.exe) to execute .vbs files. This behavior is highly characteristic of drive-by download attacks or malicious browser-based content attempting to execute local scripts for further exploitation.
Detects the creation of a Windows scheduled task via 'schtasks.exe' that specifically involves the 'MasterPackager.Updater' and execution of a 'script.vbs' file. This behavior is indicative of potential software deployment or persistence mechanisms utilizing VBScript within a scheduled task.
Page 383 of 977