Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,884
5,164
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the installation sequence of the CosmicPulse (YESROBOT) backdoor, characterized by a registry value write under HKCU\Software\Classes\.mollis followed by the execution of a Python 3.8 bootstrapper from a non-standard, suspicious directory such as AppData, ProgramData, or Temp.
Detects the execution of discovery or credential access utilities (e.g., whoami, net, reg, ldapsearch) spawned by Java-based server processes like java.exe or tomcat.exe. This activity is often indicative of an attacker leveraging a vulnerable web application to perform reconnaissance or credential harvesting on the host system.
This rule detects potential command injection attacks targeting the Zimbra 'swatchdog' service, specifically involving the abuse of SNMP trap notifications (CVE-2026-73570). The attack works by injecting malicious shell metacharacters into the 'zimbra-MIB::zmServiceName' argument, which is processed by a Perl-invoked 'swatchdog' script. The rule monitors process execution events for shell commands spawned by the swatchdog utility that contain suspicious shell operators and the targeted MIB parameter.
Detects container runtime processes (e.g., docker, podman, crictl) launching containers with elevated privilege flags (such as --privileged, --net=host, or mounting the host root directory) or pulling images from non-standard IP-based registries. These activities are indicative of potential container escapes, persistence mechanisms, or the use of untrusted/malicious container images.
Detects the execution of common enumeration tools and commands often associated with ransomware-precursor behavior. This includes the use of AdFind, dsquery, net.exe, and nltest for domain account, group, and trust discovery, as well as the execution of BloodHound/SharpHound collection activities.
Detects the use of PsExec or SC.exe to create services on multiple remote endpoints within a short time window. This pattern is characteristic of adversary-driven mass deployment of ransomware or other malicious payloads where remote execution via Windows service control is used to move laterally across a network.
Detects the execution of known Active Directory reconnaissance tools, specifically AdFind and SharpHound/BloodHound. These tools are commonly used by adversaries to enumerate domain objects, users, computers, groups, and trusts, which are essential precursors to further lateral movement and privilege escalation within a domain environment.
Detects the installation of the Windows Subsystem for Linux (WSL) feature via dism.exe or wsl.exe, or the execution of wsl.exe for non-standard administrative tasks. This activity is often a precursor to running Linux-based tools or malware on a Windows host.
Detects the execution of reconnaissance commands designed to enumerate Active Directory domain trust relationships. Attackers, including those associated with ransomware operations like INC Ransom, use these tools to map organizational structures and identify pathways for lateral movement and cross-domain propagation.
Detects behavioral patterns associated with the Everest ransomware loader, specifically the execution of a .NET host process from a non-standard parent, potentially indicating process injection, combined with network activity indicative of lateral movement or discovery, such as Wake-on-LAN packets or SMB scanning.
This rule detects the execution of common Remote Monitoring and Management (RMM) and remote access tools (e.g., ScreenConnect, AnyDesk, Atera, Splashtop, NinjaOne, Action1) when the command line includes silent install or installation flags. The detection correlates this activity with recent (within 72 hours) identity-related alerts (e.g., impossible travel, anomalous sign-in, credential compromise) for the same user, suggesting a potential high-risk scenario where an adversary is establishing remote access following a credential compromise.
This rule detects network connections initiated by unsigned executables that were recently created (within one hour) in common staging directories such as AppData, Temp, or ProgramData. It specifically targets beacons to the Telegram Bot API or Discord webhooks, which are common patterns for command-and-control (C2) communication used by malware such as the Amadey bot.
This rule identifies suspicious post-exploitation activity where an anomalous or unauthenticated NetScaler VPN session (potentially exploiting CVE-2026-88771 or CVE-2026-88772) is followed by the creation or modification of SSH authorized_keys files or related credential manipulation commands on internal hosts, suggesting an attacker establishing persistence.
Detects the execution of known Windows 'Living-off-the-Land' binaries (rundll32.exe, regsvr32.exe, mshta.exe) when they originate from web browsers or office productivity applications, or when they are executed with command-line arguments indicative of network resource loading, remote scripting, or code execution bypasses.
Detects the use of common PowerShell techniques designed to bypass the Antimalware Scan Interface (AMSI). These techniques involve manipulating internal PowerShell objects like AmsiUtils or amsiInitFailed, or using reflection to locate and modify AMSI memory structures to disable scanning.
Detects the abuse of Windows Management Instrumentation (WMI) to execute processes via wmic.exe or WmiPrvSE.exe, often combined with obfuscated command-line arguments such as encoded PowerShell or CMD commands.
Detects the abuse of built-in Windows binaries 'regsvr32.exe' and 'msbuild.exe' for proxy execution. Specifically, it flags 'regsvr32.exe' loading remote scriptlets via HTTP and 'msbuild.exe' processing project files containing inline tasks, which are common techniques used to execute arbitrary malicious code while bypassing security controls.
Detects attempts to create a memory dump of the Local Security Authority Subsystem Service (LSASS) using either the built-in 'comsvcs.dll' library via 'rundll32.exe' or by requesting specific sensitive process access rights to 'lsass.exe' from unauthorized processes.
This rule detects attempts to steal the Active Directory database (ntds.dit) and associated security files by creating volume shadow copies using native Windows utilities like ntdsutil, vssadmin, or wmic. It also monitors for direct file system access or creation attempts related to these sensitive database files within shadow copy paths.
This rule detects the loading of a suspicious DLL file named 'active_desktop_render_x64.dll' or the initiation of activity by a process named 'PDF_C2089_20260911100446.exe', which may indicate the execution of malicious code or potential process injection activity.
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Page 39 of 976