Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of node.exe from unusual parent processes and suspicious locations like AppData, Temp, or user-writable profile folders. This behavior is indicative of the TONResolver RAT, where node.exe is utilized to execute malicious JavaScript payloads disguised as legitimate processes.
This rule detects potentially malicious activity related to the deployment and execution of Node.js. It monitors for PowerShell commands downloading or extracting Node.js archives from official source paths, as well as instances where node.exe is spawned by office applications (Word, Excel, Outlook) or PowerShell, which is highly abnormal in standard production or end-user environments.
Detects the creation of persistence via a malicious Windows service named 'MixedSvc' or any service pointing to 'Mixed Reality.exe' located within 'C:\Program Files\Windows Media Player\'. This activity is consistent with the 'Operation DragonReturn' campaign and the 'Silver Fox' threat actor, where the 'Mixed Reality.exe' binary acts as a host for DLL-sideloading of the DcRAT backdoor.
This rule correlates process execution patterns to detect a potential malicious document or file download chain. It monitors for child processes spawned by common document viewers (Adobe Acrobat, Word, Excel, PowerPoint) or browsers (Edge, Chrome, Firefox) that subsequently launch suspicious interpreters (cmd, powershell, wscript) or tools (7z, rar), finally leading to potentially malicious payload execution within common user-writable directories, or obfuscated PowerShell command-line execution.
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
Detects instances where msiexec.exe or cmd.exe initiates a child process, specifically cmd.exe, to execute a batch file (.bat) located within the user's AppData/Roaming directory. This behavior is indicative of potential malicious activity, as adversaries often store and execute payloads in user-writable application data directories to maintain persistence or evade detection.
Detects LCRYX ransomware activity characterized by the execution of VBScript files via wscript/cscript, followed by attempts to disable security products (Windows Defender or third-party AVs) using command-line utilities, and establishing persistence via Registry Run keys within a 10-minute window on the same host.
Detects instances where the Windows Installer (msiexec.exe) initiates a command prompt (cmd.exe) session from an AppData directory. This behavior is indicative of potential malicious activity, as installers are sometimes abused to proxy execution of payloads residing in user-writable temporary directories.
Detects execution of cmd.exe or other binaries spawned by msiexec.exe involving the LegionLoader staging directory 'AppData\Roaming\Traiolx Custom Utils' and the 'xupdate.bat' script, which is characteristic of LegionLoader's post-installation activity.
Detects malicious process, file, and registry activities associated with Hannibal Stealer staging directories and characteristic command-line execution patterns, specifically targeting indicators like CefSharp.BrowsersSubprocess and specific DLL function delegates used in staging.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects malicious Control Panel (.cpl) file execution via legitimate Windows binaries like dllhost.exe or rundll32.exe. Attackers often abuse these binaries to bypass security controls. The rule specifically alerts on instances where these processes are launched from non-standard parent processes or from high-risk directories such as AppData or Temp.
This rule detects instances where msiexec.exe spawns cmd.exe to execute a batch file located within the user's AppData\Roaming directory. This pattern is indicative of potential malicious activity where msiexec is abused as a proxy for command execution, often used by malware to launch secondary stages from user-writable directories.
This rule detects potentially malicious use of the ClickOnce process (dfsvc.exe) by monitoring for suspicious parent processes (such as rundll32.exe or mshta.exe) spawning dfsvc.exe, or dfsvc.exe spawning unexpected child processes. ClickOnce is often abused by attackers to proxy the execution of malicious code, and these patterns are indicative of such activity.
Detects Zerologon exploitation attempts against domain controllers by monitoring for anomalous machine account password resets, execution of known exploitation tooling (e.g., zerologon_tester, secretsdump), and patterns of rapid Netlogon zero-credential authentication failures.
Detects the post-download execution stage of the abdrizak PostCSS typosquatting Windows RAT campaign. Covers three indicators: (1) wscript.exe executing a .vbs file from %TEMP% or subdirectory (e.g. update.vbs from winPatch), (2) chost.exe or any process launching loader.py as a command-line argument, (3) cmd.exe using tar to extract a .zip archive from %TEMP%.
This rule detects activities associated with the StrikeShark SharkLoader malware, specifically its attempts to suppress Event Tracing for Windows (ETW) and tamper with event logs. It identifies the use of 'wevtutil.exe' to clear security logs, 'auditpol.exe' to disable audit categories, the loading of specific DLLs ('SyncRes.dat', 'DscCoreR.mui', 'SystemSettings.dll') from suspicious AppData paths, and processes originating from these suspicious AppData paths spawning 'wevtutil.exe' or 'auditpol.exe'.
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
Detects evidence of the BeepRAT malware (via known file names, loader behavior, and specific command-line arguments) and attempts to tamper with security software through process termination, service modification, or the addition of Windows Defender exclusions.
This rule detects potentially malicious child processes spawned by Amazon Q or AWS Language Server components (e.g., amazon-q, aws-lsp-server). The rule specifically flags behavior associated with the loading of MCP server configurations, potential unauthorized access to AWS credentials, or network data exfiltration attempts through commonly abused binaries like shell interpreters, python, or curl/wget when these are not signed by Amazon.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Page 421 of 976