Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
This rule detects the exploitation of CVE-2026-20245 on Cisco SD-WAN Manager (vManage). It monitors for two distinct phases: 1) The suspicious upload of a tenant-list CSV file via CLI using a malicious filename, and 2) A subsequent privilege escalation attempt where the 'admin' user executes 'su' to switch to a 'troot' user, which is indicative of a backdoor account creation following successful exploitation.
Detects remote code execution (RCE) attempts targeting PHP 8.5.7 StreamBucket SOAP vulnerability. The rule monitors for suspicious child process creation originating from web server processes (php-fpm, php, apache, httpd) including shells, scripting engines (python, perl, ruby), or network utilities (nc, curl, wget).
Detects unauthorized persistence mechanisms on Cisco SD-WAN Manager, vSmart, and vBond nodes by monitoring for local account creation (e.g., useradd), modification of sensitive authentication files (/etc/passwd, /etc/shadow), and illicit SSH key placement in authorized_keys. This rule specifically monitors for known exploit paths involving the 'troot' account and related command-line activity indicative of unauthorized administrative access.
KQL Query from file: INC Ransomware Command Execution
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects Log4Shell JNDI exploitation attempts by scanning incoming network request data for JNDI patterns and simultaneously monitors for suspicious shell child processes (cmd, powershell, bash, sh) spawned by java.exe, indicating post-exploitation activity.
This rule detects potential discovery activities indicative of a virtual machine or virtualization environment enumeration. It monitors for the execution of wmic.exe or powershell.exe triggered by suspicious parent processes (python.exe, chost.exe) that query hardware-specific identifiers like Manufacturer, Model, or MAC Address using Win32_ComputerSystem or Win32_NetworkAdapterConfiguration.
Detects anomalous outbound network connections from node.exe processes initiated by developer tools like VS Code, npm, or installation binaries. The rule specifically monitors for patterns indicative of Command and Control (C2) communication, including high-frequency Socket.io polling, WebSocket upgrades, and long-duration connections to external, non-private IP addresses.
This rule detects potentially malicious activity associated with Java applications or the Lunar Client, specifically targeting the creation of shortcut files (.lnk, .command, .desktop) by Java processes, and the unexpected spawning of shells or interpreters by 'javaw.exe' or Lunar Client processes. These patterns are consistent with modpack-based Remote Code Execution (RCE) attempts or abuse of Electron IPC mechanisms.
Detects the installation and operation of the RustDesk remote access tool as a persistent Windows service. This behavior has been identified in the Akira ransomware intrusion chain where adversaries utilize remote access tools for post-compromise persistence and control. The rules monitor for service creation via command-line utilities (sc.exe, PowerShell), registry modifications related to service configurations, and Windows Service Control Manager events (Event ID 7045) that register RustDesk as a persistent system service.
Detects the use of net.exe or net1.exe to create domain accounts or grant them administrative privileges (Domain Admins or Enterprise Admins) in Active Directory. This behavior is indicative of pre-ransomware persistence techniques employed by the Akira threat group, where attackers create specific service accounts and elevate their privileges before ransomware deployment.
Detects remote LSASS memory dumping patterns associated with the lsassy tool, leveraging comsvcs.dll to create memory dumps of the LSASS process. The rule identifies suspicious command lines involving comsvcs.dll ordinal-based exports (ordinal #+000024), tasklist enumeration for PID discovery, and subsequent dump file creation within \Windows\Temp\. It monitors remote execution methods often observed in Bumblebee and Akira campaigns, such as WMI or DCOM/MMC-based process spawning.
Detects execution of common reconnaissance commands spawned by the AdgNsy.exe process, identified as an AdaptixC2 beacon. This behavior indicates post-exploitation discovery activity.
Detects remote LSASS memory dumping using the built-in comsvcs.dll MiniDump functionality, invoked by rundll32.exe. This activity is consistent with tools like lsassy, which leverage techniques such as SMB service creation, WMI, scheduled tasks, and DCOM/MMC to execute the dump remotely. The rule monitors for command lines containing comsvcs.dll and MiniDump, targeting the LSASS process or staging files in the Windows Temp directory.
Detects symlink or junction point creation by standard users targeting sensitive system directories, a core mechanism of CVE-2026-41091.
This rule detects process execution where the command line arguments contain keywords commonly associated with memory corruption and exploitation (e.g., shellcode, buffer overflow, heap/stack manipulation). The rule further filters for small executable files (less than 100KB) to increase the likelihood of identifying malicious tools or stagers.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Page 403 of 976