Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,485 detections
Filters
Last updated
All Time
Detection languages
8,114
7,160
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,485
11,868
5,886
5,169
4,867
Platforms
18,086
3,049
1,506
124
104
Products / Services
5,726
4,294
3,715
1,174
958
MITRE Techniques
9,481
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of WMI (via WmiPrvSE.exe or wmic.exe) to enumerate or terminate PowerShell processes. This behavior is indicative of the Amadey/StealC delivery chain, where a JScript dropper uses WMI to clean up script execution artifacts after a specified timeout, aiding in defense evasion.
Detects behavior indicative of the Vidar information stealer, specifically the mass access of web browser credential stores (Login Data, Cookies) followed by the execution of archive utilities (7z, rar, WinRAR) to stage stolen data for exfiltration.
Detects behavior consistent with the Vidar/Wingo loader, part of Operation Turb00, where a process probes for VM/sandbox artifacts, specifically the VMware Tools daemon path and WMI ETW restrictions registry keys, followed by a rapid process termination characteristic of sandbox evasion.
Detects the execution of ssh-add.exe from a Temp directory, which occurs as part of an attack chain involving a trojanized Franz Electron app. The process leverages DLL side-loading by loading malicious msys-crypto-3.dll, msys-2.0.dll, and msys-gcc_s-seh-1.dll, identified as components of the ResiLoader malware.
Detects the installation of known malicious PyPI packages ('frint', 'skytext', 'slogsec', 'logcrypt.cryptography') associated with the ChocoPoC supply chain campaign. The rule monitors process execution commands related to 'pip' package installation and tracks the appearance of malicious compiled extension files ('gradient.pyd', 'gradient.so') on the filesystem.
Detects a multi-stage attack chain beginning with the execution of suspicious processes (mstsc.exe, mshta.exe) from email clients or download directories, followed by WinRAR or unrar.exe writing files containing path traversal sequences, and concluding with the execution of a child process from a suspicious directory. This behavior aligns with exploitation attempts targeting vulnerabilities like CVE-2025-8088.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
Detects the execution of multimedia capturing utilities like ffmpeg or OBS Studio when spawned by common scripting or administrative processes. This pattern often indicates unauthorized screen, audio, or video recording potentially used in data exfiltration or reconnaissance.
Detects potential credential harvesting attempts by monitoring for the usage of Windows credential management tools (cmdkey.exe and vaultcmd.exe) and the loading of sensitive DLLs (vaultcli.dll, dpapi.dll) by non-Microsoft signed processes, which is commonly used to access stored credentials in the Windows Vault or by DPAPI-protected stores.
Detects the execution of multimedia capturing utilities like ffmpeg or OBS Studio when spawned by common scripting or administrative processes. This pattern often indicates unauthorized screen, audio, or video recording potentially used in data exfiltration or reconnaissance.
Detects the execution of the Windows binary 'certutil.exe' using flags commonly abused by adversaries to download files from remote URLs or decode base64-encoded files. It excludes instances where certutil is executed by Microsoft-signed processes from the System32 directory to reduce false positives.
Detects the execution of PowerShell with command-line arguments containing keywords indicative of in-memory download and execution, such as '-enc' or '-EncodedCommand' used in conjunction with 'IEX' (Invoke-Expression) or 'DownloadString'. This pattern is a common TTP for initial access and second-stage payload delivery, and was observed in the exploitation of CVE-2025-55182 (React2Shell).
Detects the use of regsvr32.exe to load a remote COM scriptlet via a URL. This technique, commonly known as Squiblydoo, allows adversaries to bypass application whitelisting and proxy the execution of malicious code, as regsvr32.exe is a trusted Windows binary.
Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) or command-line tool (wmic.exe) initiates potentially suspicious child processes, often indicative of lateral movement or remote command execution via WMI.
Detects the execution of mavinject.exe with the /INJECTRUNNING command-line argument. This utility is a signed Microsoft binary that can be abused by adversaries to inject arbitrary DLLs into the address space of running processes, a technique often used to evade detection or achieve code execution.
Detects the execution of known command-line utilities, script interpreters, or installers spawned by web browsers from high-risk directories such as the User Downloads, Temp, or TMP folders. This behavior is indicative of a user downloading and executing malicious files or scripts directly from a web browser.
Detects the enumeration of installed security and monitoring software, such as Sysmon, Filebeat, and Microsoft Defender, using common system administration tools including sc.exe, tasklist.exe, wmic.exe, PowerShell, and reg.exe. This activity is often associated with reconnaissance performed prior to disabling security features on a compromised host.
Detects the execution of known Active Directory enumeration tools such as AdFind and BloodHound/SharpHound, or manual net group domain queries, executed on hosts that may lack standard EDR instrumentation. This pattern is commonly associated with adversary lateral movement and reconnaissance in ransomware affiliate operations.
Detects the use of WinRAR or rar.exe to create password-protected archives or archive files within temporary, user-writable, or public directories. This behavior is indicative of data staging by an adversary to prepare information for exfiltration.
Page 394 of 976