Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of 'netsh trace' to capture network traffic, often associated with reconnaissance activity by threat actors like The Gentlemen RaaS. The rule monitors for command patterns involving trace start/stop, interface show, and specific configuration flags like 'capture=yes', 'report=no', 'filemode=circular', or output to 'ADMIN$' shares.
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects the use of the 'netsh trace' command to initiate network packet capture, executed via cmd.exe or powershell.exe. This activity is a known technique used by The Gentlemen RaaS group to perform credential harvesting from unencrypted internal network traffic by saving packet capture files to administrative shares.
Detects the creation of scheduled tasks by known Mustang Panda DLL sideloading hosts, specifically Solid PDF Creator or Citrix Receiver components. This rule identifies persistence mechanisms likely established during the post-compromise phase of espionage operations.
Detects malicious child process creation behavior associated with the BeaverTail JavaScript infostealer during the installation of compromised npm packages. The rule monitors for 'node.exe' spawning suspicious shell or interpreter processes (e.g., python, curl, powershell) in conjunction with strings indicative of known malicious delivery mechanisms (e.g., specific filenames like 'lserver.js', 'jsonwebauth', or external hosting domains).
This rule detects processes associated with scripting languages like Python and Node.js that are attempting to access clipboard data or use clipboard-related libraries (e.g., pyperclip, win32clipboard, xclip). This behavior is common in info-stealer malware, such as InvisibleFerret, which uses the clipboard to harvest sensitive user data.
Detects the creation of scheduled tasks using schtasks.exe where the task involves paths often associated with user-writable directories (ProgramData, AppData, Temp) and specific suspicious keywords. This behavior is common for adversaries seeking persistence by scheduling execution of potentially malicious payloads located in non-standard or user-writable locations.
This rule detects potentially malicious activity where 'npm' or 'node' processes spawn sensitive child processes (e.g., cmd.exe, powershell.exe, python.exe, curl.exe) in contexts associated with package installation (e.g., node_modules, postinstall scripts) or known indicators of compromise related to supply chain attacks and credential theft.
Detects suspicious modifications to Group Policy Objects (GPOs) using PowerShell cmdlets, including references to sensitive paths like SYSVOL/NETLOGON or suspicious script files, as well as the execution of 'gpupdate /force' from non-standard shell processes. These behaviors are often indicative of GPO abuse for persistence, lateral movement, or defense evasion.
Detects potential ransomware activity characterized by a high volume of file modifications (create, write, rename) involving common document/data extensions, combined with the execution of commands designed to inhibit system recovery (shadow copy deletion, BCD modifications) or perform network share enumeration within the same timeframe and on the same host.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Detects the creation of a scheduled task named 'RageGuard' using the Windows schtasks.exe utility. This behavior is indicative of the TrymeLocker malware attempting to maintain persistence on a compromised system by executing with highest privileges upon user logon.
Hunting rule loosely based off of Atomic Red Team T1518.001 test "Get Windows Defender exclusion settings using WMIC". No public in-the-wild intel reference available; correlate before alerting.
Detects the execution of mshta.exe with command-line arguments that include remote protocols (http/https) or scripts (javascript/vbscript). This behavior is commonly associated with fileless malware execution and proxying malicious code via a trusted Windows binary.
Hunting rule for tar archive creation of user home trees, common staging before scp/rsync exfiltration over SSH. Prioritize /tmp archives and remote copy in the same session.
Detects Node.js being used to establish reverse shell connections
Detects the execution of processes with command-line arguments indicative of destructive activity, such as wiping disks, partitions, or boot records, often associated with wiper malware.
Detects Odbcconf used for DLL registration as proxy execution technique
Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.
Detects the use of 'sshpass' with disabled host key checking ('StrictHostKeyChecking=no') to automate SSH connections. The rule specifically targets command lines referencing administrative accounts ('psoft', 'oracle', 'linuxadm'), a technique associated with ShinyHunters lateral movement activity.
Page 399 of 976