Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects multiple distinct attempts to inhibit system recovery features on Windows systems. It monitors for the execution of native tools like vssadmin.exe, wmic.exe, bcdedit.exe, and wbadmin.exe, as well as PowerShell commands, to delete shadow copies, disable recovery features, or remove backup catalogs. By correlating these events over a 5-minute window, it identifies potentially malicious activity aimed at preventing system recovery, which is a common behavior in ransomware attacks.
This rule detects scenarios where development tools such as VS Code (Code.exe) or npm spawn multiple child processes of Python or Node.js interpreters within a short time window, followed by those same interpreters accessing sensitive credential files (e.g., SSH keys, browser login data, or cloud configuration files). This pattern is indicative of a developer workstation compromise or a supply chain attack involving malicious code execution.
This rule detects activities related to clearing or deleting Windows Event Logs, including usage of 'wevtutil.exe' to clear specific logs, 'cmd.exe' or PowerShell ('Remove-Item') to manually delete '.evtx' files, and the erasure of the USN journal via 'fsutil.exe'. It also detects the actual occurrence of Event IDs 1102 (Security log cleared) and 104 (System log cleared). The rule correlates these events with preceding service installations within the last 24 hours to distinguish between potential attacker anti-forensics activity and routine administrative maintenance.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects the execution of a bash script dropper ('isp.sh') associated with Langflow RCE exploitation (CVE-2026-33017). The rule triggers when command-line arguments indicate an attempt to download and execute the 'lambsys.elf' Go-based cryptominer from a known malicious IP address (83.142.209.214).
Detects post-exploitation system discovery and reconnaissance commands performed by PeopleSoft service accounts (psoft, oracle, linuxadm) on Linux hosts. This activity aligns with observed techniques from the ShinyHunters CVE-2026-35273 campaign, where compromised service accounts were used to map the local environment.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects user-initiated PowerShell execution patterns associated with Woodgnat social engineering campaigns (ClickFix, FileFix, CrashFix). The rule monitors for PowerShell processes spawned by common communication and web browsing applications (Microsoft Teams, Chrome, Edge, Firefox) or script interpreters (mshta, wscript) that utilize obfuscation or non-interactive flags common in these attack vectors.
This rule detects PowerShell processes initiated where the command line contains references to specific files ('vile_Decryptor.lnk' or 'vile_icon.ico'), which are indicative of suspicious shortcut file execution or associated malware staging activity.
This rule detects suspicious process execution patterns that are characteristic of fileless malware execution or malicious script handling. It specifically targets PowerShell commands using ReadAllText to read script content from stdin/env:0, the use of Sysnative paths for architectural bypasses, and the execution of setup.cmd files from 7Zip extraction directories.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects post-exploitation of CVE-2026-22778 (vLLM libopenjp2 JPEG2000 cdef heap overflow). The overwritten AVBuffer free() pointer is set to system(), so a successful exploit spawns /bin/sh -c as a direct child of the vLLM/python inference process. Matches a shell or download/exec utility launched with a vLLM/python/uvicorn parent, excluding benign python worker children.
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects the execution of malicious LNK files (masquerading as image files) that trigger PowerShell scripts, or the subsequent execution of non-Microsoft signed Node.exe binaries from suspicious directories, characteristic of the TonRAT campaign.
Detects execution of AWS STS commands to identify the caller's identity in conjunction with suspicious outbound POST requests. This pattern is commonly used by adversaries to verify compromised cloud credentials or enumerate permissions within an AWS environment.
Detects the creation of scheduled tasks at 1-minute intervals using 'schtasks.exe' that employ masqueraded names (e.g., MicrosoftUserInterface) or execute known suspicious payloads associated with the NarwhalRAT malware (e.g., python scripts or .cat files). This behavior is characteristic of persistence mechanisms used by APT37.
This rule monitors process execution events for the 'aa-exec' utility, a tool often used in containerized environments (such as AppArmor) or specific runtime configurations, when invoked with specific command-line arguments (-p trinity, -p chrome, or -p flatpak). These patterns are indicative of specialized container or sandbox execution activities that may warrant investigation in specific enterprise environments.
This rule monitors for suspicious child processes (such as bash, curl, or aws cli) spawned by the Amazon Q IDE language server. These patterns are indicative of potential abuse of IDE plugins or language servers to execute system commands, exfiltrate credentials, or interact with cloud APIs, potentially utilizing custom MCP (Model Context Protocol) configurations.
This rule detects the execution of specific suspicious files (nvdaHelperRemote.dll or Mixed Reality.exe) when they originate from within the 'Windows Media Player' directory. Such behavior is indicative of potential DLL search order hijacking or masquerading attempts, where an adversary places malicious files in a predictable location to intercept execution.
Detects unauthorized or suspicious AWS CLI operations and sensitive IAM API calls initiated from developer tooling processes like VS Code (including the Amazon Q extension host). This behavior is often associated with the exploitation of MCP (Model Context Protocol) auto-execution vulnerabilities, where attackers attempt to use compromised developer environments to escalate privileges or exfiltrate cloud credentials.
Page 423 of 976