Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects post-exploitation of CVE-2026-22778 (vLLM libopenjp2 JPEG2000 cdef heap overflow). The overwritten AVBuffer free() pointer is set to system(), so a successful exploit spawns /bin/sh -c as a direct child of the vLLM/python inference process. Matches a shell or download/exec utility launched with a vLLM/python/uvicorn parent, excluding benign python worker children.
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects the execution of malicious LNK files (masquerading as image files) that trigger PowerShell scripts, or the subsequent execution of non-Microsoft signed Node.exe binaries from suspicious directories, characteristic of the TonRAT campaign.
Detects execution of AWS STS commands to identify the caller's identity in conjunction with suspicious outbound POST requests. This pattern is commonly used by adversaries to verify compromised cloud credentials or enumerate permissions within an AWS environment.
Detects the creation of scheduled tasks at 1-minute intervals using 'schtasks.exe' that employ masqueraded names (e.g., MicrosoftUserInterface) or execute known suspicious payloads associated with the NarwhalRAT malware (e.g., python scripts or .cat files). This behavior is characteristic of persistence mechanisms used by APT37.
This rule monitors process execution events for the 'aa-exec' utility, a tool often used in containerized environments (such as AppArmor) or specific runtime configurations, when invoked with specific command-line arguments (-p trinity, -p chrome, or -p flatpak). These patterns are indicative of specialized container or sandbox execution activities that may warrant investigation in specific enterprise environments.
This rule monitors for suspicious child processes (such as bash, curl, or aws cli) spawned by the Amazon Q IDE language server. These patterns are indicative of potential abuse of IDE plugins or language servers to execute system commands, exfiltrate credentials, or interact with cloud APIs, potentially utilizing custom MCP (Model Context Protocol) configurations.
This rule detects the execution of specific suspicious files (nvdaHelperRemote.dll or Mixed Reality.exe) when they originate from within the 'Windows Media Player' directory. Such behavior is indicative of potential DLL search order hijacking or masquerading attempts, where an adversary places malicious files in a predictable location to intercept execution.
Detects unauthorized or suspicious AWS CLI operations and sensitive IAM API calls initiated from developer tooling processes like VS Code (including the Amazon Q extension host). This behavior is often associated with the exploitation of MCP (Model Context Protocol) auto-execution vulnerabilities, where attackers attempt to use compromised developer environments to escalate privileges or exfiltrate cloud credentials.
This rule detects the use of Rclone for cloud file synchronization or configuration file creation on endpoints that have shown recent activity related to QEMU virtualization. The detection correlates process execution or file creation events involving Rclone with prior QEMU execution within a 24-hour window, which may indicate an adversary using virtualization to stage or exfiltrate data.
Detects a suspicious UAC bypass pattern associated with the DcRAT malware, where a process relaunches itself using the 'runas' verb via ShellExecuteW to escalate privileges. The rule specifically monitors for instances where an executable triggers a secondary process launch of itself, filtering out standard Windows administrative utility parents.
Detects unexpected subprocesses (bash, sh, npx) spawned by the Amazon Q language server process. This behavior is indicative of a potential exploit targeting the Model Context Protocol (MCP) auto-execution vulnerability (tracked as CVE-2026-12957), where a malicious .amazonq/mcp.json workspace configuration is used to gain unauthorized code execution.
This rule detects the use of native network utilities (wget.exe, curl.exe) executing with flags indicative of file uploads (HTTP PUT or POST) targeting archive files (zip, rar, 7z). This behavior is often associated with the direct exfiltration of staged data to attacker-controlled infrastructure.
Detects potential second-stage deployment of the Kazuar backdoor on Windows hosts, following initial access activity associated with the Gamaredon group (using Ptero-family implants). The rule monitors for a sequence involving PowerShell-based loaders (PteroPaste, PteroVDoor, PteroSetup, or PteroDee) followed by or combined with suspicious encoded PowerShell commands and the creation of Kazuar-specific named pipes or artifact markers.
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) scripts that contain patterns indicating evasion techniques. Specifically, this rule identifies the combined use of execution delays (e.g., Start-Sleep, WScript.Sleep, ping/timeout) and environment/sandbox fingerprinting (e.g., WMI queries for ComputerSystem, hypervisor detection, or CPUID) often used by malware to detect virtual environments before executing malicious payloads (typically via IEX or Invoke-Expression).
Detects Node.js executing the malicious 'setup.cjs' script with the '--no-warnings' flag. This execution sequence is associated with the 'easy-day-js' typosquat postinstall hook used in the Mastra npm supply chain compromise.
This rule detects suspicious process spawning patterns where cmd.exe appears as a child of svchost.exe, which is indicative of PPID spoofing (often associated with Cobalt Strike's spawn-to and token impersonation techniques). It validates the relationship by checking if the grandparent process is the legitimate services.exe.
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process. The rule monitors for cross-process memory access, the use of legitimate Windows tools like rundll32.exe (loading comsvcs.dll) and procdump.exe for dumping LSASS, and detection of Cobalt Strike-specific command-line patterns related to credential theft.
Page 424 of 976