Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of PsExec (psexec.exe or psexesvc.exe) where the binary is not digitally signed by Microsoft Corporation. This is often an indicator of renamed or tampered versions of the tool used for lateral movement or remote command execution.
Detects the creation of scheduled tasks using the schtasks utility that masquerade as legitimate update services (MicrosoftEdgeUpdate or GoogleUpdaterTaskSystem). These tasks are configured to run at logon with highest privileges, specifically aiming to persist the TinyRCT backdoor (associated with files such as vmwared.exe or vmtools.exe) in ProgramData directories.
Detects the use of WinRAR (rar.exe) to archive files containing web server or database source code. The detection monitors for common staging flags (-k, -r, -s, -m1), password protection (-hp), or output paths indicative of staging activity (e.g., to a 'backup' directory or 'web.rar'), originating from standard Windows program file paths.
Detects the abuse of the legitimate Windows binary regsvr32.exe for malicious purposes. This rule monitors for two common attack patterns: 1) The use of regsvr32.exe with specific command-line arguments (/i, /s, /u, /n) to load remote scripts (SCT files) or libraries from the internet, a technique known as 'Squiblydoo'. 2) Suspicious child processes spawned by regsvr32.exe, which often indicates follow-on malicious activity such as command shell execution or lateral movement tools.
Detects potential UAC bypass activity involving the hijacking of the Event Viewer (eventvwr.exe) COM object. The rule monitors for registry modifications to the 'HKCU\Software\Classes\mscfile\shell\open\command' key, followed by the execution of 'eventvwr.exe' by a suspicious parent process, indicating an attempt to elevate privileges to perform arbitrary command execution.
Detects unprivileged processes creating a new user namespace (CLONE_NEWUSER) followed by a network namespace (CLONE_NEWNET) and modifying procfs mapping files (uid_map, gid_map). This sequence is characteristic of the exploitation staging phase for CVE-2026-43503 (DirtyClone) to gain CAP_NET_ADMIN privileges and overwrite the page cache.
Detects a suspicious sequence of events on Linux where a non-root process creates a user namespace followed within 5 minutes by either network XFRM policy manipulation or the loading of specific kernel modules (esp4, esp6, or rxrpc). This behavior is characteristic of an attempt to bypass kernel security restrictions or establish unauthorized encrypted tunnels.
Detects common lateral movement patterns associated with Pass-the-Hash (PtH) attacks, specifically identifying remote execution via WMI/services, the use of explicit credentials in management utilities (wmic/net), and suspicious network connections from known administration tools over lateral movement ports.
Detects the execution of known network exploitation tools like Responder.py or MultiRelay.py, as well as unauthorized processes binding to ports used for LLMNR (UDP 5355) and NBT-NS (UDP 137), which are classic indicators of potential adversary-in-the-middle attacks.
Detects the configuration of network tunnels or IPsec-related settings using tools such as ip, setkey, racoon, or strongswan by a non-root user. This behavior is indicative of potential unauthorized tunnel establishment or lateral movement activities where a standard user attempts to bypass network controls.
This rule detects network connections initiated by common Windows script interpreters (PowerShell, WScript, CScript, MSHTA) to known public paste or text sharing services. Adversaries often use these sites to host malicious payloads, C2 configurations, or to exfiltrate data, bypassing traditional network blocks by using reputable services. The rule excludes processes signed by Microsoft to reduce noise.
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
This rule detects the use of Regsvr32.exe to execute remote scriptlets (.sct files) from external HTTP/HTTPS URLs by loading the scrobj.dll module. This technique, commonly known as 'Squiblydoo', is used to bypass application allowlisting (such as AppLocker) and proxy execution of malicious code.
Detects execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) when initialized with an INF file from potentially suspicious directories (e.g., Temp, AppData), or when cmstp.exe is observed spawning common command-line shells (cmd.exe, powershell.exe) or rundll32.exe, which is indicative of potential proxy execution or UAC bypass techniques.
Detects web server processes (e.g., httpd, nginx) spawning common shell interpreters (sh, bash, cmd.exe) that execute suspicious commands often used in reconnaissance or download stages of an attack, such as 'whoami', 'wget', or 'curl'. This behavior is characteristic of an exploited web application being used as a staging or command-and-control pivot point.
Detects indicators of the MYRA Linux RAT, including process masquerading as systemd-userdbd, persistent modifications to system locations like /etc/profile.d/ and /usr/local/lib/, and malicious cron scheduling, typically originating from a Node.js process.
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
Detects Remcos RAT masquerading as explorer.exe by launching legitimate Internet Explorer browser components (iexplore.exe, ieinstal.exe, or ielowutil.exe) in a suspended state. This activity is indicative of process hollowing or PEB modification used by Remcos to inject malicious code into a seemingly legitimate process while evading detection.
Detects behavior indicative of the Remcos RAT injecting its code into legitimate Windows processes (such as iexplore.exe, ieinstal.exe, ielowutil.exe, svchost.exe, or explorer.exe). The rule identifies this by monitoring for a process matching the Remcos naming convention that launches a secondary process in a suspended state, followed by cross-process activity that deviates from standard system behavior.
Detects a two-stage attack chain where a host downloads an image file from the network, followed by the execution of suspicious system binaries (e.g., mshta, powershell, rundll32). This pattern is characteristic of steganographic loaders like CloudEyE or DBatLoader used to extract and execute payloads like Remcos RAT.
Detects the Remcos RAT using the Windows 'attrib.exe' utility to apply hidden, system, and read-only file attributes to its installation directory within %ProgramData%\Remcos to evade detection and forensic analysis.
Page 416 of 976