Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where the Windows calculator application (calc.exe) is launched as a child process of suspicious parent applications associated with known proof-of-concept exploits. This detection aims to identify successful exploitation events where calc.exe is used as a payload to demonstrate arbitrary code execution.
Detects the execution of Python interpreters spawned by code editors or runtime environments (e.g., VS Code, Cursor, Node.js) with specific command-line arguments involving 'init'. This behavior may indicate an adversary attempting to leverage development tools to execute custom scripts, potentially for automated deployment, persistence, or malicious payload initialization.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
Detects various methods of bypassing Windows User Account Control (UAC), including auto-elevating binaries spawning suspicious child processes, registry key hijacks (e.g., in HKEY_CURRENT_USER\Software\Classes) used to execute elevated code without prompts, and attempts to disable UAC via the 'EnableLUA' registry value.
Detects a fileless execution technique used by the MYRA Linux RAT where a payload is executed from memory using memfd_create and fexecve, effectively bypassing disk-based detection. The rule identifies processes originating from Node.js or npm installation scripts that exhibit anonymous, memory-backed execution paths typical of this malware's lifecycle.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Detects suspicious behaviors during npm package lifecycle events, specifically node.exe spawning command-line interpreters (cmd.exe, powershell.exe, etc.) or initiating network connections to known malicious or suspicious domains typically associated with npm supply chain attacks.
Detects the use of the attrib.exe utility to modify file attributes by applying the hidden (+h), system (+s), and read-only (+r) flags simultaneously to files located within the ProgramData directory. This behavior is a common technique used by malware to hide artifacts from users and evade basic detection while attempting to prevent accidental deletion or modification.
Detects Remcos RAT-related User Account Control (UAC) bypass activity. The rule identifies suspicious process creation and cross-process patterns where non-Microsoft signed executables, specifically those often masquerading as explorer.exe or interacting with system-level binaries (e.g., iexplore.exe, svchost.exe, fsutil.exe), attempt to elevate privileges using COM interfaces such as CMSTPLUA.
This rule detects potentially malicious self-upgrade patterns in Node.js applications, specifically monitoring for the execution of scripts like 'sync-peer.cjs', the use of 'BACKUP_TARGET_VERSION' environment variables, or npm packaging commands initiated via lifecycle hooks (e.g., 'postinstall'). These behaviors are characteristic of supply chain attacks or automated persistence mechanisms that attempt to replace or upgrade application code during the installation or execution process.
Detects a suspicious execution pattern on Linux systems where 'memfd_create' is used to create an anonymous file in memory, followed by 'fexecve' to execute that memory-resident payload. This pattern is commonly used by fileless malware (such as the Myra RAT) to run code directly from RAM, effectively bypassing disk-based security controls.
Detects common suspicious child processes spawned by identified Remcos RAT binaries (remcos.exe or remcos_all_enabled_watchdog.exe). This rule monitors for potentially malicious process execution patterns, such as command shell abuse or unauthorized system tool usage, which are indicative of post-exploitation activity by the Remcos Remote Access Trojan.
Detects network activity and process execution patterns associated with the Amadey loader and Operation FlutterBridge. The rule monitors for unauthorized file downloads from self-hosted GitLab repositories using raw paths, delivery of malicious archives like 'protected.zip', and the execution of common downloaders (PowerShell, cmd, curl, wget) triggered by known Amadey process artifacts (Yfgfwb.exe).
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects potential Remcos RAT activity utilizing the CMSTPLUA COM interface for UAC bypass. The rule identifies instances where suspicious processes (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed from non-standard locations such as ProgramData, AppData, or Temp folders, which is characteristic of Remcos execution flows.
This rule detects persistence mechanisms and fileless execution patterns commonly associated with the MYRA malware family on Linux systems. It specifically monitors for malicious cron job creation, LD_PRELOAD library manipulation, unauthorized shell profile modifications, and memfd-based execution spawned from Node.js or npm processes.
This rule detects the execution of node.exe or npm.cmd where the command-line arguments include specific indicators associated with suspicious third-party libraries, typosquatted packages, or known malicious domains. These indicators often point to unauthorized external dependencies or potential supply chain attack patterns in JavaScript-based environments.
This rule detects potential process injection behavior associated with the Remcos Remote Access Tool. It monitors for suspicious parent-child process relationships where 'remcos.exe' is identified as a parent of 'svchost.exe' or 'explorer.exe', or where Internet Explorer components (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed in a manner inconsistent with typical Windows system process hierarchies.
This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.
Page 393 of 977