Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where the Windows Subsystem for Linux (WSL) process spawns a Windows command shell (cmd.exe) or PowerShell (powershell.exe). This pattern is often used to execute native Windows commands from within a Linux environment, potentially as a technique for stealthy command execution or to bypass traditional Windows-based monitoring and security controls.
Detects the execution of Windows Subsystem for Linux (WSL) related processes, which can be used to execute Linux commands and scripts on a Windows host, potentially allowing adversaries to bypass Windows-specific security controls.
This rule monitors for suspicious activities related to Pluggable Authentication Modules (PAM) and authentication daemons. It detects unauthorized modifications to PAM configuration and shared object files, unexpected child processes spawned by sshd, the use of LD_PRELOAD in authentication contexts, and the tracing of authentication binaries (e.g., sshd, login, sudo) via strace.
This rule monitors for process creations spawned by common web application servers (e.g., nginx, python, java, php) where the command line arguments contain indicators of a Server-Side Request Forgery (SSRF) attempt. Specifically, it looks for suspicious URL schemes (file:, gopher:, dict:, ftp:), potential authority confusion patterns (targeting cloud metadata IPs), and encoded directory traversal characters when paired with sensitive paths like 'etc' or 'proc'.
Detects the execution of PowerShell via WScript or CScript (WshShell.Run) with hidden window flags, involving the use of 'certutil' to decode a staged payload located in a ProgramData directory. This pattern is characteristic of Kimsuky loader activity.
Detects the execution of PowerShell via WScript or CScript (ActiveX Scripting hosts) where the PowerShell command line includes suspicious arguments typically used for obfuscation, bypassing security policies, or launching payloads from the ProgramData directory.
Detects network enumeration tools (netstat.exe, ss.exe) when executed by a suspicious process or from directories associated with the JFMBackdoor malware infection (e.g., fltMC.exe or common staging paths like C:\ProgramData\ and \temp\).
Detects attempts to delete or clear Linux system logs using common utilities (rm, shred, truncate, echo, cat) targeting critical log paths such as /var/log/syslog, /var/log/messages, and other authentication or kernel logs. This activity is indicative of an adversary attempting to remove evidence of their actions from the local system.
Detects the execution of PowerShell via wscript.exe or cscript.exe, often indicative of malicious VBScript or JScript files executing obfuscated or hidden payloads. The rule checks for specific PowerShell arguments (e.g., -windowstyle hidden, -noni, -decode) or references to the ProgramData directory in the command line.
Detects the use of fltMC.exe to spawn service control commands (sc.exe) or command processor (cmd.exe) with arguments for starting, stopping, creating, deleting, or configuring Windows services. This activity may indicate an attempt to manipulate drivers or services to impair system defenses or achieve persistence.
Detects the execution of the NUKESPED backdoor component 'zlrenu8.exe', which is associated with Kimsuky threat actor activity. This component is known to function as a keystroke logger using SetWindowsHookEx to capture user input.
Detects the NUKESPED backdoor (zlrenu8.exe) performing post-compromise system information discovery. The rule monitors for registry key enumeration within HKLM/HKCU SOFTWARE hives and the execution of the systeminfo.exe utility.
Detects the use of the 'net.exe' or 'net1.exe' command-line utilities to mount a local SMB share using loopback addresses (127.0.0.1 or localhost) with the '/tcpport' argument. This pattern is indicative of attempts to exploit CVE-2026-24294 to bypass NTLM authentication protections through local reflection or relay attacks.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects instances of the legitimate Windows system utility fltMC.exe running from a temporary directory (Temp or tmp) that initiates network connections. This behavior is indicative of the JFMBackdoor malware masquerading as a system tool to perform network enumeration by leveraging APIs like GetExtendedTcpTable or GetExtendedUdpTable.
This rule detects instances of the JFMBackdoor malware performing timestomping operations within the 'C:\Users\public\jfm\' directory. The malicious activity involves the use of fltMC.exe to perform DLL sideloading, followed by modifying file timestamps to evade forensic analysis and timeline reconstruction, specifically observed as part of the Red Lamassu command 0xE subcommand 0x10.
Detects the Red Lamassu batch script dropper (1.bat) leveraging PowerShell with hidden window styles to download malicious JFMBackdoor components (flt.bin, FLTLIB.dll, scr.mui, fltMC.exe) into temporary directories from known actor-controlled infrastructure (23.27.201.160).
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
This rule detects potential deployment of the 'gs-netcat' utility by identifying specific suspicious command-line patterns or file masquerading (where a file's original name doesn't match its current filename while residing outside standard system paths). It correlates these process execution events with subsequent outbound network connections on high ports (>10000) within a 5-minute window to identify potential reverse shell activity.
Detects the first-time execution of the Windows Subsystem for Linux (WSL) executable (wsl.exe) on endpoints that have not shown any WSL activity in the previous 29 days. This rule is scoped to workstations and laptops and specifically filters out endpoints tagged with developer-related identifiers to reduce noise on machines where WSL is a legitimate tool.
Detects unauthorized network connection enumeration using netstat or direct socket connections originating from fltMC.exe, which is indicative of JFMBackdoor activity. The rule monitors for netstat execution by fltMC.exe, netstat spawned from executables within temporary directories, and suspicious outbound network connections originating directly from fltMC.exe.
Page 412 of 976