Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the exploitation chain of the DirtyClone (CVE-2026-43503) vulnerability on Linux systems. The rule monitors for a sequence involving an unprivileged user (UID > 1000) creating a new user/network namespace, configuring an IPsec XFRM state with loopback source/destination addresses, modifying sensitive memory via /proc/self/mem or /proc/<pid>/mem to bypass Copy-on-Write (CoW) protections, and ultimately spawning a process with root privileges.
Detects a multi-stage attack sequence where a web-facing application (e.g., Python, Node.js) downloads a file to a temporary directory (/tmp or /var/tmp) using curl or wget, creates the file, and subsequently applies executable permissions (chmod +x) to it. This pattern is characteristic of CVE-2026-33017 exploitation targeting Langflow to deploy cryptomining binaries.
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Detects the use of OSQL.EXE to interact with Microsoft SQL Server databases and redirect query results—such as user tables or credential data—to files on disk. This activity is consistent with data collection and staging efforts used by threat actors to exfiltrate database contents.
Detects the use of native Windows utilities (vssadmin, ntdsutil, diskshadow, esentutl) or command-line execution (cmd, powershell) to access, copy, or create shadow copies of the Active Directory database file (NTDS.dit), which is a common indicator of credential dumping.
Detects exploitation attempts against GeoServer targeting CVE-2024-36401, a vulnerability involving unsafe OGC filter property name evaluation. The rule monitors for malicious HTTP patterns in incoming requests to OGC endpoints (ows, wfs, wms, wcs) and identifies subsequent suspicious process spawning by the GeoServer JVM instance that indicate successful remote code execution.
Detects the configuration and usage of personal Microsoft OneDrive accounts on corporate endpoints. This is achieved by monitoring for OneDrive process execution with personal account command-line arguments, OneDrive setup utilities configured with personal tenant identifiers, and file system activity within directory paths associated with personal OneDrive synchronization.
Detects when the IIS worker process (w3wp.exe) spawns common command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This behavior is often a strong indicator of webshell activity or exploitation of web applications such as Microsoft Exchange or SharePoint.
This rule monitors for the execution of common reconnaissance, enumeration, and scanning tools often used in post-exploitation scenarios. It detects the usage of scanners like fscan, network discovery utilities like net.exe, nltest, dsquery, and credential/directory enumeration tools like SharpHound. These tools are commonly used for domain discovery, network mapping, and collecting information for lateral movement or privilege escalation.
Detects potential exploitation of ProxyLogon (CVE-2021-26855) on Microsoft Exchange Servers. The rule identifies suspicious process activity where IIS worker processes (w3wp.exe) or Exchange UM processes (UMWorkerProcess.exe) spawn command-line shells (cmd.exe, powershell.exe, etc.) or create web shell files within Exchange-specific web directories (e.g., OWA, autodiscover, ecp).
Detects Active Directory domain group enumeration activities associated with StrikeShark post-compromise tooling. The rule monitors for Event ID 4661 object access requests to domain groups with specific access masks, as well as the execution of reconnaissance commands via net.exe or the usage of SharpGPOAbuse.exe, which are known indicators of StrikeShark operations.
Detects the creation of scheduled tasks using schtasks.exe initiated from potentially suspicious parent directories (C:\Users\Public\ or C:\Windows\Temp\) or parent processes containing 'win_guard_'. This behavior is often associated with malware attempting persistence.
Detects instances of the wusvc.exe process being executed and subsequently performing file write or module load operations. This pattern is often used by adversaries to mask malicious activity by masquerading as the legitimate Windows Update service.
This rule detects bulk execution (5+ events within 60 seconds) of Windows system utilities icacls, cacls, and takeown. These tools are commonly used by adversaries to modify file or directory permissions (DACLs) to gain access to protected files or maintain persistence. The rule specifically monitors for common patterns used to grant access to sensitive users (e.g., Everyone, Administrators) or interaction with critical system paths.
Detects the SNOWLIGHT dropper (disguised as the Windows Update Service 'wusvc.exe') attempting to establish an outbound network connection to a known malicious C2 infrastructure (38.60.253.35) on port 8084. The rule also accounts for the use of non-standard port communication and monitors for suspicious process masquerading outside of protected system directories.
Detects execution of PowerShell commands that use the ExecutionPolicy Bypass flag while concurrently attempting to suspend BitLocker protection. This behavior is highly characteristic of ransomware activity, specifically associated with the ShrinkLocker malware, where the adversary disables disk encryption protection to facilitate malicious operations or subsequent encryption.
Detects Pay2Key ransomware attempting sandbox evasion by executing the Windows timeout utility with a 10-second delay, initiated from the SysWOW64 command prompt.
Detects the execution of VILE ransomware by correlating the launch of the binary with the creation of specific artifacts used for system information discovery, specifically timezone-based geofencing and anti-analysis configurations.
Detects evidence of VILE ransomware behavior involving token and privilege manipulation, including the use of Windows API functions such as AdjustTokenPrivileges, OpenProcessToken, and DuplicateTokenEx, as well as potential EDR bypass indicators via NT syscalls like NtCreateWaitCompletionPacket.
Detects the use of built-in Windows utilities 'wbadmin.exe' and 'bcdedit.exe' with arguments that inhibit system recovery features. Specifically, it monitors for the deletion of the Windows Backup Catalog using 'wbadmin.exe' and the disabling of system recovery/boot failure handling via 'bcdedit.exe'. These actions are commonly performed by ransomware or adversaries to prevent system recovery.
Detects the use of the Windows 'fsutil' utility with the 'setZeroData' argument to zero out file content. This technique is often used by adversaries to perform data destruction or prevent file recovery.
Page 401 of 976