Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects exploitation attempts against Flowise by leveraging a case-sensitivity bypass in environment variable parsing. Attackers inject variants like 'node_options' into the environment, which bypasses security denylists, allowing the 'NODE_OPTIONS' variable to be set. This enables remote code execution (RCE) via the '--require' flag in child Node.js processes, alongside subsequent activities like marker file creation, registry-based persistence, or unauthorized outbound network connections from the Flowise service.
Detects the activation of BeepRAT's offline keylogger component. The rule identifies the execution of loader components or associated processes (such as Tiny C Compiler, LuaJIT, or custom named binaries) that facilitate the installation of a low-level keyboard hook (WH_KEYBOARD_LL) to intercept user input, which is then stored locally for later exfiltration.
Detects the execution of tcc.exe with specific command-line arguments '-nostdlib', '-run', and a reference to a 'config.ini.c' file. This pattern is indicative of the execution of potentially malicious scripts or payloads, often seen in the context of TCC (Take Command Console) or similar utilities being used to compile or run code after delivery.
Detects the creation or modification of an mcp.json file within IDE configuration directories (.vscode, .amazonq), followed shortly by the execution of shell or interpreter processes (bash, sh, cmd, powershell, npx) by the IDE process. This behavior suggests the installation of a malicious Model Context Protocol (MCP) server configuration that could facilitate command execution or persistence within the developer environment.
Detects suspicious child process activity originating from common IDEs or AI language server processes that indicates AWS credential exfiltration. The rule monitors for command-line patterns indicative of credential dumping or exfiltration, such as the use of AWS CLI commands, curl, or npx with the Model Context Protocol (MCP) in conjunction with attempts to access sensitive environment variables or redirect output.
This rule detects potentially malicious child processes spawned by Amazon Q or VS Code language server processes. It monitors for suspicious shell command-line invocations (e.g., bash, sh, cmd.exe) or tools (npx, python) immediately following the activation of language server processes, specifically looking for patterns associated with the unauthorized auto-loading or execution of Model Context Protocol (MCP) configuration files or utilities, potentially related to vulnerability patterns involving workspace-based execution.
Detects the Ghidra reverse engineering suite spawning suspicious child processes such as command shells, scripting interpreters, or network utilities. This activity often indicates an attempt to automate reverse engineering tasks or interact with the system in an unintended manner by potentially malicious scripts or plugins.
Detects potential abuse of System Informer's phsvc service for privilege escalation or execution via rundll32, as well as unauthorized child process spawning by the SystemInformer process. This behavior is associated with proof-of-concept exploits targeting the System Informer service.
Detects anomalous process creation where svchost.exe or explorer.exe is spawned by a process other than standard system parents (e.g., services.exe, wininit.exe). This behavior is consistent with SystemBC (Coroxy) reflective DLL loading or process hollowing, where malicious code is injected into core Windows processes to evade detection.
Detects the execution of PowerShell with suspicious flags, obfuscation, or download cradles often used by the SystemBC/Coroxy malware to facilitate second-stage payload delivery and C2 activity.
Detects anomalous child process execution spawned by the AnyDesk service, indicative of exploitation of the adprinterpipe named pipe. This vulnerability involves a low-privileged attacker supplying malicious IStream bytes to the service to trigger code execution in the SYSTEM context.
Detects a suspicious sequence of events where a Gitea act_runner process spawns a container with dangerous namespace or capability flags (e.g., --pid=host, --cap-add=ALL) followed by the execution of 'nsenter' in the same environment, indicating an attempt to escape the container to the host.
Detects instances where ImageMagick (magick.exe) or legacy conversion tools (convert.exe) spawn Ghostscript executables (gswin64c.exe, gswin32c.exe) from non-standard or user-writable directories (e.g., Temp, AppData, Public). This pattern is indicative of a delegate path hijacking attack, where an adversary attempts to execute arbitrary code by forcing a vulnerable application to load a malicious Ghostscript binary instead of the legitimate, installed version.
This rule detects persistence mechanisms associated with BeepRAT (a DcRAT variant) by correlating the creation of suspicious files (DLL, EXE, or C files) in user-writable directories (e.g., AppData, Temp, ProgramData) with the subsequent execution of 'schtasks.exe /create'. It specifically monitors for task creation commands referencing these suspicious paths, known loader binaries (rundll32, regsvr32, tcc.exe), or specific naming conventions like 'WindowsUpdateTempFileCleanUp'.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects local privilege escalation attempts targeting the SystemInformer PhSvc helper service. The technique involves abusing the trust check within the PhSvc service by using rundll32.exe to connect to the SiSvcApiPort ALPC port and invoke privileged helper APIs, such as PhSvcApiCreateProcessIgnoreIfeoDebugger, to spawn processes with elevated privileges.
Detects potentially malicious activity associated with the Ghidra reverse engineering framework, including the spawning of unexpected non-Java child processes, loading of suspicious project files (.gzf/.gar), loading of unsigned extensions from non-standard directories, and unexpected outbound network connections from decompiler or Java processes.
This rule detects persistence mechanisms associated with the SHARDLOADER threat activity, specifically monitoring for the creation of suspicious Registry 'Run' keys using the 'MediumNetMonIt' value or via scheduled task creation referencing known staging paths under 'C:\ProgramData\IDM\logs\'.
Detects execution of the SharpADWS utility or anomalous network connections to the Active Directory Web Services port (9389) that are not initiated by legitimate processes such as lsass.exe, svchost.exe, or the legitimate Microsoft.ActiveDirectory.WebServices.exe binary.
This rule detects potential persistence mechanisms by monitoring for the creation of specific, suspicious scheduled tasks or the modification of registry values. The patterns flagged include known indicators of malicious activity such as specific directory paths (e.g., \ProgramData\IDM\logs\ or \Microsoft\VaultCache\) and known malicious file names associated with unauthorized background execution.
This rule detects the creation of a new Windows service where the executable path is located in suspicious directories (e.g., ProgramData, AppData, Temp, Users Public). It correlates the service installation event (using sc.exe) with the subsequent execution of the binary by services.exe within a two-hour window, identifying potential persistence mechanisms or malicious service-based execution.
Page 422 of 976