Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation or modification of a registry run key named 'MsEdgeUpdate' that points to an executable named 'svchost.exe' located within an 'AppData' directory. This behavior is highly suspicious as it mimics a legitimate Microsoft Edge update process to achieve persistence while running an arbitrary executable from a user-writable path.
Detects post-compromise Active Directory reconnaissance activities using net.exe or wmic.exe to enumerate domain users, groups, computers, and sessions. The rule identifies anomalous behavior by monitoring for at least 3 distinct reconnaissance categories triggered by common scripting interpreters (PowerShell, cmd, pythonw, or node.exe) within a 5-minute window.
Detects instances where wscript.exe or cscript.exe executing a VBScript file subsequently spawns taskkill.exe with arguments intended to terminate PowerShell processes. This is a common pattern used by malicious scripts to disrupt security monitoring or automated management tasks.
Detects the execution of ScreenConnect (ConnectWise) remote support client processes with command line arguments indicative of a remote session initiation (e.g., Guest access connection). This pattern is often used by adversaries to establish persistence or remote control of compromised systems.
Detects modifications to Windows Registry keys responsible for UAC behavior (ConsentPromptBehaviorAdmin and EnableLUA) performed by common command-line utilities. Such modifications can be indicative of attempts to disable or weaken User Account Control (UAC) to facilitate privilege escalation or defense evasion.
Detects the use of PowerShell commands that reflectively load .NET assemblies into memory using 'Reflection.Assembly::Load' or 'Assembly.Load'. This technique is frequently utilized by malicious scripts and fileless malware to execute code directly in memory, bypassing traditional disk-based detection mechanisms.
Detects execution of specific shell commands (shell, kill, upload, stop) often associated with remote access trojans or backdoors. This rule monitors process creation events where these specific command verbs are present in the command line of either the process itself or its initiator, commonly seen in scenarios where a backdoor receives commands via system execution primitives like execvp() or posix_spawnp().
Detects the execution or network communication involving python-build-standalone, a tool often used by developers to deploy portable Python environments. In an environment, the unauthorized use of this tool may indicate an adversary attempting to deploy their own Python interpreter to execute malicious scripts, effectively bypassing environment-specific restrictions or configurations.
Detects network communication with known malicious domains associated with fraudulent or malicious 'Adblock for YouTube' browser extensions, as well as suspicious process command lines related to main world script injection performed by these extensions.
Detects the execution of known remote access and remote management tools (e.g., TeamViewer, AnyDesk) where the process was initiated by a web browser, suggesting potential drive-by downloads or social engineering attacks involving remote access software.
This rule detects the execution of 'hdiutil' to attach a disk image with the '-nobrowse' flag, initiated by various scripting interpreters (bash, zsh, python, etc.) or terminal applications. This pattern is frequently used by adversaries to silently mount malicious payloads or tools contained within disk images while bypassing user interaction.
Detects reconnaissance activity targeting Active Directory group structures and membership, utilizing common administrative tools such as net.exe, PowerShell, and dsquery. This rule identifies patterns associated with domain group discovery and identification of privileged accounts.
Detects persistence mechanisms associated with the MYRA Linux RAT, including malicious library injection via LD_PRELOAD using /usr/local/lib/.libcache.so, creation of persistence scripts in /etc/profile.d/, and process masquerading where a process executes as 'systemd-userdbd' but is not launched by the legitimate systemd manager.
This rule detects the invocation of local AI/LLM CLI utilities (e.g., ollama, llama-cpp) by potentially malicious or automated parent processes. It specifically flags scenarios where non-interactive or scripting-based processes (such as WScript, PowerShell, or Python) attempt to use these AI tools, particularly when the command line includes keywords related to sensitive data discovery, such as 'password', 'token', or 'private key'. This behavior is characteristic of infostealer activity (e.g., QUIETVAULT) attempting to use AI tools for automated reconnaissance and credential extraction.
Detects a suspicious sequence of events where a non-root user executes the unshare utility to create a new user and network namespace, followed immediately by the execution of the tc (Traffic Control) utility with parameters (ingress, filter, pedit) indicative of network traffic manipulation or potential exploit exploitation within the created namespace.
Detects the execution of known exploit-related binaries or command lines, including references to specific exploit source files (e.g., 'pedit_cow_demo', 'packet_edit_meme'), CVE identifiers, or specific traffic control (tc) configurations potentially used in exploitation activities.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Process Spawns Multiple Recon Processes
Cortex XDR
Detects anomalous host reconnaissance patterns characterized by the execution of four or more distinct discovery tools (e.g., systeminfo, ipconfig, net, whoami) by a single process within a 24-hour period. This behavior is indicative of an adversary performing environment discovery following initial access or privilege escalation. This will not catch discovery commands that are run in "memory", only those that spawn an additional executable like whoami.
This rule detects multi-stage attack patterns indicative of Linux privilege escalation or exploit staging. It tracks the creation of known exploit-related files in temporary directories, the compilation of exploit source code, downloading of scripts from GitHub to temporary directories, and the execution of binaries or commands (e.g., 'unshare', 'tc') often associated with kernel-level exploits. It flags hosts where multiple such indicators are detected sequentially within a single session.
Detects execution of script interpreters (wscript.exe, cscript.exe) or HTML Application host (mshta.exe) when spawned by Microsoft Office applications (Winword, Excel, PowerPoint, Outlook) or mshta.exe. This pattern is characteristic of the Gamaredon group's spear-phishing delivery chains (e.g., PteroOdd, PteroDum) that utilize macro-enabled documents or malicious HTA files to execute malicious VBScript.
Detects instances where rundll32.exe is spawned by PowerShell.exe, specifically targeting patterns often associated with malware downloaders and stage-two payload execution. The rule filters out common system DLLs and legitimate rundll32 usage to reduce noise.
Page 415 of 976