Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the potential tampering of IIS logging configurations within a short duration following suspected web shell activity. It monitors for the execution of appcmd.exe or PowerShell commands that disable or modify IIS logging, specifically targeting sites or configurations after an IIS worker process (w3wp.exe) has performed activity associated with a webshell. This pattern is indicative of an attacker attempting to conceal their footprint after gaining access.
Detects attempts to clear Windows event logs using the native 'wevtutil' command-line utility or PowerShell 'Clear-EventLog' command. The rule applies elevated risk levels when the activity is initiated by system-level processes or accounts, which is often indicative of adversary activity attempting to remove forensic evidence of post-exploitation actions.
This rule detects the uninstallation or removal of the ModSecurity module from an IIS server, followed by suspicious POST requests to .aspx files within a 30-minute window. This behavioral pattern is indicative of an attacker disabling web application firewall (WAF) protections before attempting to exploit vulnerabilities or upload web shells.
Detects the creation of ASPX files in sensitive SharePoint directories (masterpage, layouts) by the w3wp.exe process, which is indicative of web shell deployment. Additionally, this rule identifies instances where w3wp.exe spawns shell processes like cmd.exe or powershell.exe, suggesting potential command execution via a compromised web server.
Detects suspicious PowerShell command lines associated with the TonRAT implant, which is distributed via .lnk shortcut files. The rule identifies obfuscated PowerShell execution spawned by shortcut files, the download of Node.js runtimes from external sources, and the staging of obfuscated JavaScript payloads in temporary directories.
Detects presence of the malicious Chrome extension ID in process command lines, file paths, or registry/preferences artifacts on managed endpoints. Tune logsource to your collection (Sysmon process_creation shown).
Detects the execution of 'aws sts get-caller-identity' spawned by IDE-related processes such as VS Code extension hosts or Amazon Q language servers. This pattern may indicate cloud credential reconnaissance performed by a malicious MCP (Model Context Protocol) server or compromised development extension (CVE-2026-12957).
Detects the execution of a /bin/sh root shell initiated by /bin/su where the parent process indicates a non-root context. This pattern is characteristic of CVE-2026-46331, where an attacker exploits the page cache (pedit COW) to inject shellcode into the in-memory cached /bin/su binary, effectively gaining root privileges without on-disk modification.
Detects command lines that reference known supply chain attack targets or commonly used package management tools like npm and pypi, which can be indicators of supply chain compromise.
Detects anomalous process execution where a non-privileged user attempts to execute /bin/su to transition to UID 0 (root) without a legitimate parent process (such as sudo, sshd, or login). This activity is indicative of the pedit COW (CVE-2026-46331) exploit, which involves poisoning the /bin/su page cache to achieve unauthorized privilege escalation via shellcode injection.
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it. This technique is often used for lateral movement and remote code execution.
Detects evidence of CVE-2026-43503 (DirtyClone) exploitation, where an unprivileged user attempts to gain root access by corrupting the in-memory page cache of /usr/bin/su. The detection monitors for suspicious invocation of 'su -c /bin/sh' by non-root users and the subsequent spawning of root shells from an unprivileged parent process.
Detects Millenium RAT payloads that masquerade as legitimate Windows processes (such as MsEdgeUpdate or svchost.exe) by running from temporary directories (AppData or Temp). The rule also monitors for associated persistence mechanisms via HKCU Run registry keys.
Detects anomalous network traffic from svchost.exe processes exhibiting suspicious behavior indicative of DcRAT, specifically reconnaissance activities that involve gathering system information and security product details for exfiltration to a Command and Control (C2) server.
Detects malicious activity associated with the TONResolver RAT, specifically the initiation of a system reconnaissance beacon containing host information and the establishment of registry-based persistence. The rule monitors for a node.exe process residing in a specific AppData path performing network communication and registry modifications to the HKCU Run key.
Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.
Detects execution of 'tasklist.exe' when spawned by suspicious or unexpected parent processes, specifically flagging instances where the parent process resides in an AppData directory or originates from specific executables often leveraged by malicious actors. This behavior is indicative of system enumeration and discovery activity.
This rule detects suspicious PowerShell command-line activity characterized by the use of execution policy bypass flags, obfuscated strings referencing BigInteger or character manipulation, and the potential retrieval of malicious scripts from temporary directories.
Detects the execution of DcRAT in Operation DragonReturn, which uses a specific hardcoded named mutex 'Global\ShitSetupOn26126k' to ensure only a single instance of the malware runs on the infected host. This acts as an execution guardrail to prevent multiple processes from running simultaneously.
Detects outbound WebSocket connections on common web ports initiated by node.exe that do not originate from standard Node.js installation directories. This behavior is characteristic of the TONResolver RAT, which utilizes AES-256-CBC encrypted communication over WebSockets with a 20-second keepalive interval.
Detects the use of wmic.exe or PowerShell to query the WMI 'SecurityCenter2' namespace for 'AntiVirusProduct' information. This is a common discovery technique used by adversaries to identify installed security software to assess their environment before launching payloads.
Page 420 of 976