Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects Windows Terminal (wt.exe) spawning PowerShell with specific command-line arguments, typically indicative of user-pasted malicious commands from ClickFix fake update lures linked to Rapid Brigantine.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing, which are indicative of malicious discovery.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Detects UAC bypass abuse of eventvwr.exe (Event Viewer) used by Remcos RAT to silently escalate privileges. eventvwr.exe is an auto-elevate COM-based binary; malware spawns it as a child process to gain elevated execution without a UAC prompt. The rule filters out legitimate parent processes like explorer.exe, mmc.exe, taskmgr.exe, and SearchProtocolHost.exe, as well as processes originating from standard Windows system directories.
This rule detects a multi-stage Linux privilege escalation exploitation sequence often associated with kernel vulnerabilities (such as CVE-2023-32233). It identifies: 1) The creation of a user namespace to acquire CAP_NET_ADMIN privileges, 2) The use of 'tc' (traffic control) with 'pedit' actions by a non-root user, 3) The loading of the 'act_pedit' kernel module by a non-root user, 4) Execution of known proof-of-concept binaries (e.g., PACKET_EDIT_MEME, pedit_cow_demo), and 5) Post-exploit evidence cleanup involving the clearing of system page caches via 'drop_caches'.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) where the initiating parent process is not a common legitimate process like explorer.exe, cmd.exe, powershell.exe, svchost.exe, or system.exe, and is also not a web browser (Chrome or Firefox). This pattern can indicate an attempt to execute malicious VBScript or JScript files, potentially delivered via phishing, where the script is launched by an unusual or obfuscated parent process to evade detection.
Detects suspicious command-line activity indicative of an adversary attempting to disable security controls (such as SELinux, AppArmor, UFW, and IPTables) or performing cleanup and maintenance tasks on suspected cryptominer-related files on a Linux system.
This rule detects the suspicious execution of the Bun runtime spawned as a child process of Node.js or during npm package installation, which is a pattern observed in the Miasma/Mini Shai-Hulud supply chain attacks. It monitors for child processes named 'bun' or 'bun.exe' initiated by Node.js, or activities involving 'bun run _index.js' and 'node-gyp' which are characteristic of loader chains used to facilitate credential theft during package installation.
Detects the execution of Node.js from common user-writable directories like Downloads, TEMP, or APPDATA. This behavior is indicative of malicious implants, such as TonRAT or PureRAT, which often masquerade as legitimate tools or are delivered via phishing campaigns like Photo ZIP ClickFix, where a user is tricked into launching a payload from an untrusted location.
Detects suspicious activity originating from web application processes (python, uvicorn, gunicorn) involving the download and execution of a payload (isp.sh), followed by the deployment and execution of a binary (lambsys) within hidden directories in /var/tmp/. This rule flags indicators of compromise such as curl/wget calls to suspicious IPs, creation of hidden directories, and execution of binary files in temporary storage locations.
Detects potential unauthorized cryptocurrency mining activity by correlating process execution, network connections to known mining pools or C2 IPs, and the presence of known miner binaries in temporary directories. The rule calculates a confidence score based on the overlap of these behavioral indicators.
Detects suspected command and control (C2) activity leveraging Cloudflare Tunnel or Workers. The rule identifies two patterns: 1) Repeated polling (>5 connections in 10 minutes) to Cloudflare infrastructure by suspicious scripting processes (e.g., PowerShell, WScript), and 2) A 'dead-drop' resolver pattern where a process contacts a Cloudflare domain, followed by a DNS query to an unrelated domain shortly thereafter, suggesting the retrieval of a new C2 address.
This rule detects potential exploitation of the DirtyClone vulnerability (CVE-2026-43503) by correlating prerequisites (XFRM state/policy creation, specific kernel module loading, or namespace manipulation) with a subsequent local privilege escalation where an unprivileged process spawns a root shell using 'su'.
Detects a two-stage activity pattern where a non-root user compiles C source code using common compilers (gcc, clang) within writable system directories (/tmp, /dev/shm, /var/tmp) using command-line arguments indicative of kernel or low-level exploits (e.g., skbuff, xfrm, static compilation), followed by the immediate execution of a newly created binary from those same directories within 60 seconds.
Detects the execution of major web browsers (Chrome, Firefox, Internet Explorer) with command line arguments containing keywords related to browser extensions, addons, or plugins. This pattern is often used to load unauthorized or malicious extensions for persistence or browser hijacking.
Detects activities related to the compilation and execution of the DirtyClone PoC exploit (CVE-2026-43503) on Linux systems, including compilation from source, direct execution of the binary, and permission modifications on binaries within world-writable directories.
Detects coordinated security defense evasion activities by the Lambsys cryptominer campaign. The rule triggers when a shell process (bash, sh, or dash) is used to stop or disable security services (auditd, ClamAV, osquery, Falco, CrowdStrike Falcon), forcibly terminate their processes using pkill or kill -9, and delete or shred critical system security and audit logs (auth.log, syslog, audit).
Detects usage of the Windows certutil.exe utility with flags commonly associated with malicious activity, including downloading files from remote URLs or decoding/encoding files within temporary or application data directories.
Detects the use of regsvr32.exe to execute remote scriptlets (SCT files) via HTTP, HTTPS, or FTP protocols. This technique, often referred to as 'Squiblydoo', allows for proxying code execution to bypass application whitelisting and execute arbitrary code directly from a remote web server without writing the script to the local disk.
Detects the creation of WMI Event Subscriptions using wmic.exe or scrcons.exe. Adversaries can use WMI event subscriptions to achieve persistence by executing malicious code when a specific event occurs, such as system boot or user logon.
Page 426 of 976