Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,485 detections
Filters
Last updated
All Time
Detection languages
8,114
7,160
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,485
11,868
5,886
5,169
4,867
Platforms
18,086
3,049
1,506
124
104
Products / Services
5,726
4,294
3,715
1,174
958
MITRE Techniques
9,481
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
Detects the execution of PowerShell or PWSH where the command line contains common environment variables and paths associated with the Windows Startup folder. This pattern is commonly used by adversaries to achieve persistence, ensuring malicious scripts execute upon user login.
Detects the execution of AppleScript files by the Script Editor application or the osascript utility, often associated with Maccy.scpt, which may indicate unauthorized script execution or automation attempts.
Detects repeated execution of the 'pbpaste' command initiated by the 'Finder' application where the parent process path originates from within the '/Library/Application Support/' directory. This behavior is indicative of a potentially malicious macOS plug-in or background component attempting to periodically monitor and extract clipboard data.
Detects a process masquerading as 'Finder' (i.e., having a different file path than the legitimate macOS Finder) that attempts to open System Settings, System Preferences, or the 'open' command to interact with Apple System Preferences related to Full Disk Access or Security settings. This behavior is indicative of an adversary attempting to modify privacy permissions or bypass system security controls.
Detects the execution of the 'csrutil status' command, which is used to check the status of System Integrity Protection (SIP) on macOS. This query specifically looks for this command being executed by 'osascript' or 'Script Editor', which are common methods used to automate or hide the command execution.
Detects process execution attempts where the binary is located in the /private/tmp directory, specifically targeting a file named 'System Settings'. Executing binaries from temporary directories is a common technique used by attackers to stage and run malicious payloads while attempting to blend in with legitimate-looking filenames.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
Detects instances where the Ghidra software suite (via analyzeHeadless or ghidraRun) or its associated Java runtime initiates unexpected child processes, such as common system utilities (e.g., cmd.exe, powershell.exe, calc.exe) or executes scripts from untrusted locations like Temp, Downloads, or network shares. This behavior is indicative of potential exploitation attempts, such as arbitrary code execution triggered by a malicious project or script import.
Detects various pre-execution and environment fingerprinting behaviors indicative of the Grandoreiro banking trojan. This includes WMI-based security product enumeration, execution of unsigned payloads from suspicious AppData paths, detection of security analysis/debugging tools, virtualization environment checks, and C2 communication attempts via geolocation services.
Detects the execution of wmic.exe with commands querying Windows Management Instrumentation (WMI) classes (AntiVirusProduct, SecurityCenter2, Win32_Product) often used by the Grandoreiro banking trojan to identify installed security software and sandbox environments. The rule specifically monitors for suspicious parent-child relationships, such as wscript.exe, cscript.exe, or mshta.exe spawning wmic.exe, especially when the originating script or binary is unsigned or originating from non-standard paths like AppData.
This rule detects potential exploitation of the Ghidra vulnerability CVE-2026-45115, which allows arbitrary code execution during the loading of malicious project files or scripts. It monitors for suspicious child processes (e.g., cmd.exe, powershell.exe, bash) spawned by core Ghidra executables (ghidraRun, analyzeHeadless), which is characteristic of successful exploitation.
Detects the execution of VS Code Tunnel processes (code-tunnel.exe or code.exe with tunnel arguments) initiated by processes other than standard development-related parent processes (e.g., explorer, terminal, IDEs). This behavior may indicate an adversary attempting to establish persistent unauthorized remote access to a compromised host using the VS Code Tunnel functionality.
Detects reflective PE loading behavior potentially associated with the GIFTEDCROOK malware family. The rule monitors PowerShell processes that interact with the Windows API NtProtectVirtualMemory to set memory pages to PAGE_EXECUTE_READWRITE (0x40), a common technique for staging and executing shellcode in process memory.
Detects indicators of the KuinaExtractor infostealer, including specific named pipes/objects, the creation of a 'zenith_debug.txt' file in user profile directories, and the presence of build-related aliases ('kuina1999', 'k0to') in process command lines or file paths.
Detects the execution of PowerShell commands that exhibit characteristics of reverse shells, such as the use of Nishang or Invoke-PowerShellTcp scripts, or the combination of web-download commands with expression evaluation. The rule also calculates a risk score based on the presence of common AMSI bypass flags (e.g., hidden windows, execution policy overrides) and specific reverse shell indicators.
This rule detects potentially malicious PowerShell or Command Prompt execution patterns by monitoring for suspicious command-line flags often used by malware for stealth, such as hidden windows, script policy bypasses, and file content retrieval from specific directories. It identifies processes that exhibit multiple risk-indicating characteristics, such as being launched from LNK files, using execution policy bypass flags, or performing remote file content access.
Detects a suspicious persistence mechanism where a LNK file in the user startup folder launches cmd.exe, which subsequently executes a hidden PowerShell process. The PowerShell process uses 'Get-Content' to read and 'Invoke-Expression' (IEX) to execute a file located at C:\ProgramData\WC3. This activity is associated with the UAC-0226 / GIFTEDCROOK delivery chain.
Detects AI-powered development tools like Claude Code (running via node) spawning shell interpreters, executing common setup/configuration scripts, or invoking network utilities during project initialization. This activity is indicative of indirect prompt injection attacks where an adversary lures an AI agent into executing malicious code from a repository.
Detects AI coding agents (such as Claude Code, Cursor, Copilot CLI, etc.) spawning shell interpreters (bash, cmd, powershell) to execute installation or configuration scripts from within git-cloned repository directories. This activity is indicative of indirect prompt injection attacks where an adversary manipulates the agent into autonomously running malicious setup code.
Page 390 of 976