Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where the Microsoft Compiled HTML Help executable (hh.exe) spawns wscript.exe. This behavior is a common indicator of a Compiled HTML Help (CHM) file being used to execute an embedded VBScript payload, often as part of an initial access or early stage infection chain.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
This rule detects two suspicious behaviors associated with the TinyRCT malware family: the execution of common installer or archiver utilities in the Downloads folder that terminate within two seconds, and the use of 'choice.exe' for self-deletion of an executing process within a short timeframe.
Detects the execution of VBScript files using wscript.exe with the /B (batch) flag when the file is located within user-specific directories such as AppData, Temp, or user profiles. This pattern is commonly used by malware and loaders to execute scripts stealthily in user-writable locations.
This rule detects the execution of PowerShell via a WScript process (wscript.exe) as the parent, combined with suspicious command-line flags such as hidden window style, encoded commands, or references to the dynv6.net domain often used by attackers for C2 infrastructure.
Detects host profiling activities performed by Kimsuky malware loaders, specifically the use of WMI queries for process enumeration or the execution of 'tasklist' commands. The rule identifies markers often found in the output of these enumeration scripts to identify potential pre-payload reconnaissance.
This rule detects scenarios where the Microsoft HTML Help executable (hh.exe) is used to open a .chm (Compiled HTML) file, which then triggers the execution of wscript.exe. This behavior is a common technique used by attackers to execute malicious scripts hidden within CHM files, bypassing security controls by leveraging a legitimate system binary to initiate script execution.
Detects Node.js processes being executed with specific require flags or environment variables, while having parent processes or command-line arguments indicative of Flowise integration. This behavior is often associated with the execution of custom MCP (Model Context Protocol) tools or extensions within a Flowise workflow, which could potentially be abused for unauthorized operations or persistence.
Detects attempts to escape a Docker container to the host filesystem by exploiting directory traversal vulnerabilities within the 'docker cp' command. It identifies suspicious CLI arguments indicating path traversal, the presence of known PoC artifacts, and file write events initiated by the Docker daemon outside of expected container directory paths.
This rule detects potential local privilege escalation attempts targeting the AnyDesk service. An attacker can exploit the insecure permissions of the 'adprinterpipe' named pipe created by the AnyDesk service to impersonate a client and execute arbitrary commands with NT AUTHORITY\SYSTEM privileges. The rule monitors for suspicious process creation, COM registration changes, anomalous pipe connections, and suspicious DLL loads stemming from AnyDesk processes.
Detects indicators of compromise associated with CVE-2026-45115 in OpenVPN Connect, including suspicious child processes spawned by OpenVPN, the creation of known PoC marker files, and the execution of commands containing exploitation strings related to echo script injection.
This rule detects anomalous activities associated with RustDesk, such as spawning suspicious child processes, dropping files related to known session permission bypass proof-of-concepts, communicating with non-standard relay servers, or performing file write operations in sensitive system temporary directories, which indicates potential session hijacking or unauthorized remote access.
Detects network activity associated with the Grandoreiro banking trojan, specifically identifying C2 communication tunneled over WebRTC/STUN (port 3478) or MQTT (Azure/Google Cloud services) originating from processes executing out of the AppData\Local directory. This behavior aligns with Grandoreiro's known DLL side-loading mechanism where legitimate but vulnerable binaries are used to load malicious libraries.
Detects execution of the 'docker cp' command containing directory traversal sequences ('../', '..") in the command line arguments. This pattern is indicative of attempts to exploit path traversal vulnerabilities to read or write files outside the intended container scope, potentially leading to container escape.
Detects potential exploitation of FFmpeg via memory corruption vulnerabilities in RASC or DLTA codecs. The rule monitors for two indicators: FFmpeg spawning unexpected child processes (e.g., cmd.exe, PowerShell, calc.exe) after media processing, or FFmpeg being invoked with RASC/DLTA codec flags while processing media files located in common user-writable directories (Temp, Downloads, AppData).
This rule detects the execution of container runners (act-runner/gitea-act-runner) with insecure container isolation flags, such as mounting the host root filesystem, disabling security profiles (seccomp/apparmor), or running with host namespaces and excessive capabilities. These configurations indicate potential container escape attempts or misconfigurations that allow significant host-level access.
This rule detects when a command-line shell (bash, sh, cmd, powershell) is spawned by a parent process (curl, git, php, ssh) that has recently established an outbound network connection on port 22 (SSH). It also flags instances where the child shell process subsequently opens a network listener, often indicating a potential reverse shell or unauthorized remote access attempt.
Detects rapid enumeration of system binaries related to SSH and networking libraries (libssh2, libcurl, libgit) or version checks within a 5-minute window, which may indicate reconnaissance or pre-exploitation activity related to vulnerabilities like CVE-2026-55200.
Detects the Flowise application launching a Node.js child process with a --require flag, which indicates an attempt to exploit an environment variable case-sensitivity bypass (e.g., node_options vs NODE_OPTIONS) in the MCP environment to preload malicious JavaScript code.
Detects instances where ImageMagick (magick.exe or convert.exe) spawns Ghostscript (gswin64c.exe, gswin64.exe, or gs.exe) from a directory other than the standard Ghostscript installation path. This behavior is indicative of a search order hijack where an attacker places a malicious binary in a location searched before the legitimate Ghostscript installation.
Detects the use of 'sshpass' to automate SSH authentication, often used for lateral movement. The rule monitors command lines for the 'sshpass' utility combined with 'StrictHostKeyChecking=no' and specific service accounts (psoft, oracle, linuxadm) often targeted by threat actors such as ShinyHunters.
Page 404 of 976