Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,485 detections
Filters
Last updated
All Time
Detection languages
8,114
7,160
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,485
11,868
5,886
5,169
4,867
Platforms
18,086
3,049
1,506
124
104
Products / Services
5,726
4,294
3,715
1,174
958
MITRE Techniques
9,481
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the dropping, service creation, or execution of known vulnerable drivers and associated BYOVD tools. These tools are used by The Gentlemen RaaS group to escalate privileges to kernel level and terminate endpoint security products.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects the creation or manipulation of WMI event subscriptions using wmic.exe, powershell.exe, or mofcomp.exe. These tools are commonly abused by adversaries to establish persistence by triggering malicious code execution via WMI event filters, consumers, and bindings.
Detects the creation of local user accounts and group membership additions associated with 'rage_master_' naming conventions or hidden accounts using '$' suffix, using net.exe, net1.exe, or PowerShell commands. The rule further correlates these activities to identify bulk account creation efforts on a single endpoint.
This rule detects potential privilege escalation or backdoor creation by monitoring for two primary indicators: 1) The modification of Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, osk.exe, utilman.exe, magnify.exe, narrator.exe, atbroker.exe) to point to unauthorized debuggers, and 2) The execution of common command interpreters or suspicious binaries spawned directly by these accessibility processes, which are commonly used in lock-screen bypass attacks.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
Detects the execution of the libpwn_cve_2026_55200_server.py Python script, which is identified as a malicious SSH scaffold targeting CVE-2026-55200. This script facilitates exploitation of libssh2 clients by binding to a specific port and delivering malformed packets during the pre-authentication phase.
Detects instances where the Windows calculator application (calc.exe) is launched as a child process of suspicious parent applications associated with known proof-of-concept exploits. This detection aims to identify successful exploitation events where calc.exe is used as a payload to demonstrate arbitrary code execution.
Detects the execution of Python interpreters spawned by code editors or runtime environments (e.g., VS Code, Cursor, Node.js) with specific command-line arguments involving 'init'. This behavior may indicate an adversary attempting to leverage development tools to execute custom scripts, potentially for automated deployment, persistence, or malicious payload initialization.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
Detects various methods of bypassing Windows User Account Control (UAC), including auto-elevating binaries spawning suspicious child processes, registry key hijacks (e.g., in HKEY_CURRENT_USER\Software\Classes) used to execute elevated code without prompts, and attempts to disable UAC via the 'EnableLUA' registry value.
Detects a fileless execution technique used by the MYRA Linux RAT where a payload is executed from memory using memfd_create and fexecve, effectively bypassing disk-based detection. The rule identifies processes originating from Node.js or npm installation scripts that exhibit anonymous, memory-backed execution paths typical of this malware's lifecycle.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects suspicious behaviors during npm package lifecycle events, specifically node.exe spawning command-line interpreters (cmd.exe, powershell.exe, etc.) or initiating network connections to known malicious or suspicious domains typically associated with npm supply chain attacks.
Detects the use of the attrib.exe utility to modify file attributes by applying the hidden (+h), system (+s), and read-only (+r) flags simultaneously to files located within the ProgramData directory. This behavior is a common technique used by malware to hide artifacts from users and evade basic detection while attempting to prevent accidental deletion or modification.
Detects Remcos RAT-related User Account Control (UAC) bypass activity. The rule identifies suspicious process creation and cross-process patterns where non-Microsoft signed executables, specifically those often masquerading as explorer.exe or interacting with system-level binaries (e.g., iexplore.exe, svchost.exe, fsutil.exe), attempt to elevate privileges using COM interfaces such as CMSTPLUA.
This rule detects potentially malicious self-upgrade patterns in Node.js applications, specifically monitoring for the execution of scripts like 'sync-peer.cjs', the use of 'BACKUP_TARGET_VERSION' environment variables, or npm packaging commands initiated via lifecycle hooks (e.g., 'postinstall'). These behaviors are characteristic of supply chain attacks or automated persistence mechanisms that attempt to replace or upgrade application code during the installation or execution process.
Detects a suspicious execution pattern on Linux systems where 'memfd_create' is used to create an anonymous file in memory, followed by 'fexecve' to execute that memory-resident payload. This pattern is commonly used by fileless malware (such as the Myra RAT) to run code directly from RAM, effectively bypassing disk-based security controls.
Detects common suspicious child processes spawned by identified Remcos RAT binaries (remcos.exe or remcos_all_enabled_watchdog.exe). This rule monitors for potentially malicious process execution patterns, such as command shell abuse or unauthorized system tool usage, which are indicative of post-exploitation activity by the Remcos Remote Access Trojan.
Detects network activity and process execution patterns associated with the Amadey loader and Operation FlutterBridge. The rule monitors for unauthorized file downloads from self-hosted GitLab repositories using raw paths, delivery of malicious archives like 'protected.zip', and the execution of common downloaders (PowerShell, cmd, curl, wget) triggered by known Amadey process artifacts (Yfgfwb.exe).
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
Page 392 of 976