Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
This rule detects suspicious activity associated with the Bun runtime after an npm package install. It flags instances where Bun, or download utilities (curl/wget) fetching 'bun.sh', are spawned from Node.js-related processes (npm, node, node-gyp) particularly when located in common temporary or cache directories, indicating potential supply chain compromise or unauthorized runtime deployment during build processes.
Detects a sequence of events where a non-root user attempts to manipulate kernel components (specifically involving xfrm/esp modules via ip or modprobe) followed immediately by a sudo or su command, suggesting an attempt to load malicious kernel modules or exploit kernel vulnerabilities to escalate privileges.
This rule detects various methods used to copy or access the Active Directory database (NTDS.dit), a common technique used by attackers to dump domain credentials. The rule monitors for the use of ntdsutil with 'ifm' (install from media) arguments, vssadmin to create volume shadow copies of the NTDS file, esentutl directly interacting with the NTDS database path, and common file copy utilities attempting to copy the NTDS.dit file.
Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).
Detects suspicious execution of Node.js processes initiated by VS Code (or Cursor) that appear to be running JavaScript payloads disguised as font files (.woff2) or other suspicious assets. It also monitors for the creation or modification of '.vscode/tasks.json' files by package managers or source control tools, which could indicate the configuration of malicious 'folderOpen' tasks used for persistence or automated execution upon workspace opening.
This rule detects the execution of potentially malicious processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe) initiated by mmc.exe or explorer.exe, excluding known legitimate Microsoft Management Console (MMC) flags and common management snap-ins. This pattern is indicative of potential proxy execution or misuse of system administration utilities to run unauthorized code.
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
Detects DLL sideloading behavior associated with Operation DragonReturn, where the malicious executable COU_ITR-1_to_4_AY2026-27.exe launches or drops malicious components (nvdaHelperRemote.dll or Mixed Reality.exe) within the Windows Media Player directory.
Detects execution of processes associated with Millenium RAT that contain specific strings indicating sandbox evasion techniques, including environment checks and stalling loops (Thread.Sleep/MemoryInfoDetector) used to bypass automated analysis.
Detects the creation of a Windows scheduled task that attempts to execute a VMware-related binary (vmwared.exe) under the guise of 'MicrosoftEdgeUpdate' on system logon with the highest privileges. This behavior is indicative of a persistence mechanism attempt.
Detects the execution of process images known as 'XDRAgent.exe' or VMware administration tools ('vmtools.exe', 'vmwared.exe') when their command lines include patterns commonly associated with reverse shell communication, suspicious IP addresses, or unauthorized administrative arguments.
Detects svchost.exe or 'Mixed Reality.exe' spawning common system and security enumeration tools (such as wmic.exe, systeminfo.exe, or tasklist.exe) with command-line arguments indicative of the DcRAT 'SendInfo()' routine. This pattern is characteristic of malware performing reconnaissance of installed security software and system identification.
This rule monitors for node.exe processes running from the AppData directory initiating multiple network connections to non-private (external) IP addresses over common web ports (80, 443, 8080, 8443). Running Node.js from user-writable temporary directories can be an indicator of malicious activity or the execution of unauthorized web applications attempting command and control communication.
Detects sandbox evasion behavior linked to the Operation DragonReturn DcRAT loader. The malware uses the GetTickCount64 API in a tight loop with Sleep(1) calls to identify and detect sandbox environments that accelerate system time. The rule monitors for the suspicious execution of specific executables and subsequent process injection into svchost.exe.
Detects the execution of 'JuicyPotato', a known tool used for local privilege escalation on Windows systems by abusing the BITS service or DCOM to achieve arbitrary process execution as SYSTEM.
Detects the DcRAT malware implant executing svchost.exe as a child process of 'Mixed Reality.exe', a behavior used during the malware's SendInfo phase to enumerate security products and prepare for AMSI patching.
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
Detects the TONResolver RAT infection chain, where PowerShell is used to download the Node.js runtime to a non-standard directory under AppData\Local\Nodejs, followed by the execution of a JavaScript payload. This behavior is associated with campaigns utilizing Cloudflare-proxied (.cfd) domains to distribute malicious components.
Detects execution of PowerShell processes spawned by script hosts (wscript.exe, mshta.exe) with common bypass/encoded flags. The rule identifies suspicious command-line patterns involving known malicious infrastructure domains or specific suspected payload filenames, indicative of the Millenium RAT dropper activity.
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Page 396 of 976