Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation or modification of Windows Registry Run keys that point to files within user-writable directories (AppData or Temp). This behavior is correlated with preceding execution of script interpreters (PowerShell, WScript, CScript, MSHTA, Node, or CMD) on the same endpoint, which is a common pattern for dropper or RAT installation stages.
Detects instances where a browser or email client spawns a PowerShell process containing common obfuscated command-line arguments (e.g., -enc, IEX, bypass), which then subsequently executes node.exe or wscript.exe. This pattern is characteristic of the TONResolver infection chain, where a phishing lure triggers initial code execution via browser or email client to deploy a JavaScript-based RAT.
Detects the execution of 'whoami' via 'cmd.exe' when the parent process is suspicious, such as running from an AppData folder, originating from a suspicious directory named 'Liu5GgJiKiKqe2Qs', or when 'svchost.exe' is executed outside of the standard 'System32' directory. This pattern is commonly used for UAC elevation checks or reconnaissance by malicious software.
Detects host-level configuration changes indicative of preparing a system for the CVE-2026-46331 pedit COW exploit. This includes enabling unprivileged user namespaces via sysctl and disabling security mitigations or removing the act_pedit kernel module.
Detects anomalous process spawning behavior initiated by AI IDE extensions (e.g., Amazon Q, Claude Code, Cursor) when loading Model Context Protocol (MCP) configuration files. The rule flags instances where these IDE components trigger suspicious child processes or command-line executions, which could be indicative of remote code execution (RCE) via malicious mcp.json workspace configurations.
Detects ClickFix social engineering lures where a web browser spawns script interpreters (cmd.exe, powershell.exe, or mshta.exe) with command-line arguments indicative of malicious activity, such as base64-encoded payloads, remote download cradles, or execution with hidden window flags.
Detects execution of PowerShell commands indicative of Gamaredon (Shuckworm) threat group activity. The rule monitors for PowerShell processes utilizing command-line arguments typical of their 2025 downloader toolset (such as PteroPaste, PteroDee, and PteroCache), specifically combining encoded commands, in-memory execution (IEX/Invoke-Expression), and remote file fetching (DownloadString).
Detects post-compromise activity where an adversary enumerates Domain Admins group memberships using standard Windows utilities (net, net1, nltest, or PowerShell) immediately followed by the use of curl to exfiltrate data via HTTP POST requests to suspicious external infrastructure.
Detects malicious attempts to impair system defenses on Linux hosts, specifically targeting AppArmor, SELinux, firewalls (UFW/iptables), and security monitoring agents (Crowdstrike/osquery/Aliyun) by the 'lambsys' cryptominer campaign. This behavior aligns with adversary attempts to evade detection and maintain persistence or resource consumption.
This rule detects potentially unauthorized installation of extensions in Visual Studio Code (VSIX) or plugins in JetBrains IDEs (IntelliJ, PyCharm, WebStorm). It flags installations that do not originate from verified official marketplaces, which may indicate the manual installation of malicious or supply-chain compromised development environment extensions.
Detects instances where WinRAR.exe is observed writing potentially malicious script or link files (.hta, .vbs, .js, .ps1, .lnk) into the Windows Startup folder. This pattern is indicative of exploitation of CVE-2025-8088, a path traversal vulnerability in WinRAR often leveraged by the Gamaredon group to establish persistence.
Detects LCRYX ransomware behavior involving the creation of autorun.inf files on removable drives combined with the execution of VBScripts from removable media using wscript.exe, indicative of a worm propagating via USB devices.
Detects msiexec.exe spawning cmd.exe with a command line containing specific indicators related to 'Traiolx Custom Utils' and 'xupdate.bat'. This behavior is indicative of potential malicious installation scripts or installer abuse.
This rule detects potential credential harvesting or malware delivery by identifying an email client (e.g., Outlook) launching a PDF reader, which subsequently executes a web browser. This sequence is a common indicator of a user interacting with a malicious link or 'Sign' button inside a PDF attachment opened directly from an email.
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it. Threat actors use this for rapid lateral movement.
This rule detects potentially malicious activity where a web browser (e.g., Chrome, Edge, Firefox) spawns suspicious child processes (e.g., mshta.exe, wscript.exe) with command-line arguments that include indicators of script execution, remote code download, or command invocation, which is a common pattern in drive-by download attacks and malicious link execution.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with command line arguments containing suspicious keywords such as 'AppData\Roaming', '.bat', 'xupdate.bat', or 'Traiolx Custom Utils'. This behavior is indicative of potentially malicious installation or post-exploitation activities.
Detects the execution of rundll32.exe when initiated by msiexec.exe or cmd.exe, particularly when the rundll32.exe process path or command line involves the AppData\Roaming directory or references specific custom utilities, which is a common pattern for fileless or staged malware execution.
This rule detects potential LegionLoader activity by monitoring for specific file staging in AppData/Roaming directories and suspicious registry queries related to security settings and Internet Explorer/Windows configuration values. The rule correlates process execution via msiexec.exe, rundll32.exe, or dllhost.exe with the creation of known staging artifacts and security-weakening registry modifications.
Detects evidence of active exploitation targeting the libarchive ZIP entry declared-vs-actual size boundary vulnerability. The rule identifies the execution of known proof-of-concept (PoC) scripts (make_debuginfod_zip.py, run_stock_marker.py) as well as the creation of specific marker files or CLI output from bsdunzip/bsdtar that confirm successful boundary exploitation.
This rule detects suspicious activity associated with the BeepRAT malware loader chain. It monitors for the execution of TCC.exe (a common name for Tiny C Compiler used by some malwares for dynamic compilation) with specific command-line arguments like -nostdlib and -run, as well as the spawning of suspicious child processes (cmd.exe, powershell.exe, or conhost.exe) by TCC.exe or the presence of a temp.bin file in the command line, which is indicative of BeepRAT shellcode loading behavior.
Page 397 of 976