Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Detects the removal of Sysmon, which could be a potential attempt at defense evasion
Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.
Hunting rule loosely modeled after Atomic Red Team T1048.002 test "Exfiltrate data in a file over HTTPS using wget". No public in-the-wild intel reference available; correlate before alerting.
Detects the execution of PowerShell via explorer.exe containing a long Base64-encoded command string, which is characteristic of the Potemkin Loader used in ClickFix-style attacks to evade detection.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
This rule detects potentially malicious behavior associated with web browser processes, including the execution of Python scripts, the loading of browser extensions from non-standard directories like AppData or Temp, the creation of Python scripts by browsers in temp folders, and outbound network connections by Python processes following browser activity. These patterns are often associated with browser-based exploitation, extension-based malware, or initial access stages where a browser is used as a conduit for malicious code execution.
Detects instances where common web browsers (Chrome, Edge, Firefox, Brave) spawn command-line tools or script interpreters (cmd, PowerShell, wscript, mshta) as child processes. This behavior is highly indicative of drive-by download attacks, including the 'ClickFix' technique, where users are socially engineered into executing malicious commands under the guise of fake browser updates or error resolution.
Detects the execution of known living-off-the-land binaries (LOLBins) such as mshta.exe, certutil.exe, bitsadmin.exe, wscript.exe, or cscript.exe directly by explorer.exe. This pattern is indicative of a user-initiated execution, potentially triggered by social engineering lures like the 'ClickFix' technique, where a user is tricked into pasting and running malicious commands in the Windows Run dialog or a command prompt context.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects the use of bitsadmin.exe to initiate file transfers from remote HTTP/HTTPS locations. This behavior is frequently used by adversaries to download malicious payloads onto a host using legitimate system utilities.
Detects the use of rclone.exe to exfiltrate files to Dropbox, specifically looking for process execution patterns and network connections to Dropbox API endpoints consistent with the Gamaredon PteroBox exfiltration module.
Detects a sequence of events characteristic of a privilege escalation exploit (referenced as CVE-2026-46331). The chain involves an unprivileged user creating a user namespace, followed by the configuration of traffic-control (tc) filters, and finally accessing sensitive setuid binaries or memory files (/proc/self/mem), indicating an attempt to escalate privileges to root.
Detects a suspicious multi-stage infection sequence associated with DcRAT, characterized by a process spawning a child with references to image files (.jpg/.jpeg), followed by the loading of an unsigned DLL from the same directory, and culminating in a TLS network connection within a narrow time window.
Detects multiple indicators of process injection into svchost.exe including suspicious process access rights, remote thread creation, unexpected loading of .NET CLR modules, and the subsequent spawning of suspicious child processes. The rule aggregates these signals to identify potential fileless execution or persistence mechanisms within a legitimate system process.
Detects exploitation attempts of the Zerologon (CVE-2020-1472) vulnerability using Impacket tools. The rule monitors for unauthorized machine account password resets via Netlogon, execution of common exploitation scripts like zerologon_tester.py or secretsdump.py, and suspicious NTLM anonymous authentication patterns often associated with the exploit.
Detects the execution of a self-deletion routine associated with the TinyRCT backdoor. The rule identifies the use of the Windows 'choice' command to introduce a deliberate delay before deleting the malicious executable 'PerfWatson2.exe' from the AppData Local directory.
Detects the execution of the TinyRCT backdoor, which attempts to masquerade as the legitimate PerfWatson2.exe binary. The detection focuses on the process running from the AppData/Local directory, a common location for user-level malicious payloads.
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
Detects a potential privilege escalation attempt targeting the DirtyClone (CVE-2026-43503) vulnerability, where an unprivileged process executes /usr/bin/su with specific command line arguments to spawn a shell without proper authentication, effectively gaining root access.
Page 400 of 976