Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.
Detects behavior where PowerShell or pwsh executes msiexec.exe to silently install an MSI file located in a temporary directory with a GUID-prefixed filename, optionally following a recent download from a remote URL.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects the execution of the rclone.exe utility with copy, sync, move, or copyto command-line arguments, correlated with outbound network connections to Wasabi S3 or MEGA cloud storage domains.
Detects the execution of two or more distinct Active Directory discovery, credential extraction, or coercion tools (such as NetExec, Kerbrute, noPac, PetitPotam, SoftPerfect Network Scanner, or Impacket scripts) on the same device within a 1-hour window.
Detects Salat Stealer dropping and executing copies of Lightshot.exe in trusted directories such as Windows NT, Edge, and Chrome application paths, as well as process spawn chains involving masqueraded Lightshot executables.
Detects PHP SAPI processes accessing /proc/self/mem (or equivalent memory mapping) and subsequently spawning a Unix shell, which is characteristic of web shell activity or exploitation of PHP memory corruption/injection vulnerabilities like zif_system.
Detects the sequence where a private key file is written to the host followed by the execution of ssh.exe with parameters indicating a reverse port forwarding tunnel (-R), an identity file (-i), and background execution (-N or -f) within a 30-minute window.
Detects instances where rundll32.exe is executed with no arguments or minimal arguments, matching the typical Cobalt Strike spawn-to sacrificial process behavior. Aggregated per device, account, and parent process.
Detects host reconnaissance activities (such as whoami or systeminfo) executed via Remote Monitoring and Management (RMM) tools or accompanied by suspicious PowerShell download and execution activity within a specific time window.
Detects usage of system utilities to discover system network connections
Detects process command lines referencing browser credential
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.
Detects when a Java or JavaW process spawns a Unix shell (bash, sh, dash) with command-line arguments indicative of a reverse shell utilizing /dev/tcp and interactive shell flags.
Detects files written under Magento pub/media/custom_options/quote by a web server or PHP process, and flags when a subsequent process command line references the uploaded file, indicating potential web shell activity.
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects situations where a web server process (such as PHP, Apache, Nginx) creates or modifies a user's .bashrc profile file, or executes a shell command to write to .bashrc, indicating potential web shell persistence activity.
The KQL rule detects a ClickFix-style technique in which script hosts reference files disguised with an f_* naming pattern in browser profile cache directories. The key behavioural indicators are:
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
The following analytic detects a Chromium-based browser being launched with both the --hide-crash-restore-bubble and --restore-last-session
command-line flags by a process other than the browser itself. Focusing on browser command lines that silently restore the previous session
without showing the "Chrome didn't shut down correctly" notification. This activity is significant because browser hijackers and adware droppers
forcefully terminate the browser to tamper with its preference files, then relaunch it with these flags so that the victim does not notice the
interruption and lands on an attacker-controlled page. If confirmed malicious, this could indicate that the browser profile was modified to
hijack the default search engine, new tab page or to side-load a malicious extension.
command-line flags by a process other than the browser itself. Focusing on browser command lines that silently restore the previous session
without showing the "Chrome didn't shut down correctly" notification. This activity is significant because browser hijackers and adware droppers
forcefully terminate the browser to tamper with its preference files, then relaunch it with these flags so that the victim does not notice the
interruption and lands on an attacker-controlled page. If confirmed malicious, this could indicate that the browser profile was modified to
hijack the default search engine, new tab page or to side-load a malicious extension.
Page 4 of 976