Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where PowerShell.exe spawns Regasm.exe. Regasm.exe is a known Windows utility that can be abused to proxy execution of arbitrary code, a technique often used by adversaries to bypass application controls or execute malicious payloads.
Detects the modification of Windows Defender exclusion settings using the Add-MpPreference or Set-MpPreference PowerShell cmdlets. Adversaries often abuse these cmdlets to add malicious files or directories to the exclusion list, allowing them to evade antivirus detection.
Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.
Detects the use of msiexec.exe to execute installation commands specifically involving Visual C++ Redistributable DLLs (vcredist_x64.dll or vcredist_x86.dll) with quiet installation flags. This behavior may indicate an attempt to bundle or install dependencies via msiexec to proxy execution.
Detects a sequence of events where a non-root user attempts to manipulate kernel components (specifically involving xfrm/esp modules via ip or modprobe) followed immediately by a sudo or su command, suggesting an attempt to load malicious kernel modules or exploit kernel vulnerabilities to escalate privileges.
Detects the execution of Dropbear SSH binaries (dropbear, dropbearkey, dropbearmulti) on identified OT, ICS, or SCADA assets. The rule flags suspicious configurations such as the use of non-standard ports (2222, 44818), remote port forwarding, or running in the foreground, which may indicate unauthorized remote access or tunneling on sensitive operational technology infrastructure.
Identifies post-exploitation reverse shells resulting from the LiteLLM RCE vulnerabilities. The rule looks for processes initiated by 'litellm' (either directly or via python running litellm) that then spawn child processes with common reverse shell command line patterns such as 'bash -i', '/dev/tcp/', 'nc -e', or 'sh -i'.
Detects the execution of known LLMNR, NBT-NS, and SMB relaying tools such as Responder, Inveigh, and MultiRelay, or the use of their specific command-line arguments, which are commonly used by adversaries for adversary-in-the-middle attacks to capture or relay authentication material.
Detects the execution of known LLMNR, NBT-NS, and SMB relaying tools such as Responder, Inveigh, and MultiRelay, or the use of their specific command-line arguments, which are commonly used by adversaries for adversary-in-the-middle attacks to capture or relay authentication material.
Detects the use of the native Windows curl.exe utility to download a ZIP archive from a remote location, a technique used by the Potemkin Loader to retrieve malicious RMM components while avoiding PowerShell-based security controls.
Detects the execution of ClickOnce applications (via dfsvc.exe, rundll32.exe with dfshim.dll, or by opening .application/.appref-ms files) that are being launched from a remote web or file share source. This behavior is a common technique for proxying malicious code execution.
Detects suspicious execution of command-line utilities (cmd, powershell, pwsh) spawned by Windows Explorer (explorer.exe). The rule flags processes with long command lines or those containing evidence of obfuscation (Base64 encoding) or common command-line indicators used for weaponized scripts, such as download requests or expression invocation.
Detects the execution of known Remote Monitoring and Management (RMM) tools from common user-writable or temporary directories (Temp, Downloads, AppData, Public). The rule further filters for processes commonly abused for payload delivery and command execution (powershell.exe, cmd.exe, wscript.exe), or processes containing typical obfuscation and download indicators, excluding benign system process initiators.
Detects the execution of MAVInject.exe (Microsoft Application Virtualization Injector) with the /INJECTRUNNING parameter, a technique used to inject malicious code into a running process to evade detection.
Detects potential abuse of Active Directory Certificate Services (AD CS) by monitoring for suspicious command-line activity from 'certreq.exe' and 'certutil.exe' associated with certificate enrollment, submission, or management. It also identifies the staging of certificate-related files (.pem, .pfx, .p12, .crt, .cer, .key) in common user directories.
Detects multiple executions of wscript.exe or cscript.exe within an hour that involve command-line arguments containing business-related keywords (e.g., Invoice, Payment) and script extensions (.vbs or .vbe). This behavior is often indicative of automated malware staging, such as malicious macro-enabled documents spawning script engines.
Detects post-exploitation persistence activity following a DirtyClone (CVE-2026-43503) privilege escalation. The rule monitors for the creation of local user accounts via binaries like useradd and usermod, as well as unauthorized modifications to sensitive Linux configuration files such as /etc/sudoers or /etc/shadow, specifically when executed with root-level privileges.
Detects execution of processes associated with Grixba malware (GT_NET.exe) or suspicious attempts to clear Windows event logs using built-in utilities (wevtutil, wmic) in conjunction with common command shells or the malware itself.
Detects high-frequency non-standard process executions involving WMI queries that specifically target virtual environment artifacts (e.g., VMware, VirtualBox, VBoxService, QEMU). This behavior is characteristic of sandbox or virtualization evasion, where malware attempts to identify if it is running in a virtualized or analysis environment to potentially alter its behavior.
Detects instances where package managers like npm, pip, or python execute shells or scripting interpreters with command-line arguments indicative of software installation or build processes. This pattern is common in supply chain attacks where malicious packages run code during their installation phase.
Detects usage of the WinRAR utility (rar.exe) with command-line arguments indicative of file archival, specifically using flags commonly associated with automated data collection or suspicious staging patterns such as password-protected archives (-hp) or specific file paths like 'web.rar' or those within VMware directories.
Page 384 of 977