Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects potential abuse of Active Directory Certificate Services (AD CS) by monitoring for suspicious command-line activity from 'certreq.exe' and 'certutil.exe' associated with certificate enrollment, submission, or management. It also identifies the staging of certificate-related files (.pem, .pfx, .p12, .crt, .cer, .key) in common user directories.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
This rule detects instances where PowerShell or PowerShell Core (pwsh.exe) are spawned as child processes of common COM object host processes (e.g., wscript.exe, mshta.exe, rundll32.exe). The detection specifically looks for command-line arguments containing encoded commands or indicators of download cradles (e.g., IEX, Net.WebClient, DownloadString), which are common patterns for fileless execution and malicious script staging.
Detects unauthorized access or modification to common CI/CD credential files (.npmrc, .pypirc, .git-credentials, jenkins credentials.xml) and CI/CD configuration files (.github/workflows, .gitlab-ci.yml). The rule monitors both file system activities by non-standard processes and the execution of command-line tools that reference these sensitive files.
Detects a suspicious command pattern where 'cmd.exe' writes a transient batch file, immediately executes it, and then deletes it. This behavior is a common EDR evasion technique used to execute malicious payloads without leaving persistent traces on the disk.
Detects the execution of consent.exe from a temporary directory path, which is often used in UAC bypass attacks to masquerade as the legitimate Windows UAC prompt process.
This rule detects the execution of common network share enumeration tools or scripts, specifically looking for the execution of netscan.exe (or similar) or PowerShell commands utilizing common share finding utilities like Invoke-ShareFinder, CheckShareAccess, or commands exporting share information to files.
Detects attempts to dump the memory of the Local Security Authority Subsystem Service (LSASS) process using the built-in Windows comsvcs.dll via rundll32.exe or tasklist commands, a common technique used for credential harvesting.
Detects the execution of ClickOnce applications (via dfsvc.exe, rundll32.exe with dfshim.dll, or by opening .application/.appref-ms files) that are being launched from a remote web or file share source. This behavior is a common technique for proxying malicious code execution.
Detects automated payroll fraud attempts by monitoring for scripting engines initiating HTTP connections to known payroll platforms (e.g., Workday, ADP) or spawning child processes with payroll-related command-line arguments. This behavior is indicative of post-AiTM session abuse, where attackers manipulate financial accounts or automate unauthorized payroll changes via malicious scripts.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects a burst of commands consistent with Akira ransomware's recovery inhibition phase, where multiple system recovery features are disabled or deleted (e.g., Volume Shadow Copies, Windows Backup Catalog, Boot Recovery) within a 5-minute window on the same endpoint.
This rule monitors for suspicious activities related to System Informer (formerly Process Hacker) and its associated service (phsvc.exe). It detects unauthorized or unusual execution patterns, such as unsigned client binaries, shell spawning, or the use of specific proof-of-concept (PoC) command-line arguments that indicate attempts to abuse the service's privileged capabilities for process management or evasion.
Detects the installation of RustDesk as a persistent Windows service. RustDesk is a remote access tool that has been observed in intrusion chains, including those involving Akira ransomware, to provide hands-on-keyboard access to threat actors.
Detects a suspected malicious activity sequence where PowerShell is used to download the cloudflared utility from GitHub, followed by a silent MSI installation of cloudflared. This sequence is indicative of post-exploitation activity often associated with Bumblebee malware leading to the establishment of covert C2 tunneling, frequently observed in Akira ransomware intrusion chains.
Detects the execution of consent.exe from a specific Bumblebee loader installation path (ApplicationInstallationFolder_11) within the user's temporary directory. This activity is indicative of the Bumblebee loader, which utilizes DLL side-loading of a malicious msimg32.dll and incorporates locale-based checks to evade execution in certain regions.
This rule monitors for the creation of the 'adprinterpipe' named pipe by the AnyDesk remote support application. This behavior can be indicative of remote session activity or misuse of the AnyDesk software, often used as a vector for remote command and control.
Detects the creation of a 'MasterPackager.Updater' scheduled task by a suspicious instance of RegAsm.exe (hollowed process). The task is configured to execute a VBScript located in C:\Users\Public every two minutes, a known tactic associated with AsyncRAT delivery chains.
Detects the execution of Gitea/Act runner or Docker containers with dangerous configurations that allow host-level access, such as privileged mode, host PID/IPC namespaces, or disabled security profiles (AppArmor/Seccomp). These configurations are often used to escape container isolation or execute commands on the underlying host.
Detects instances where the 'splunkd' process acts as a parent to common command-line interpreters (e.g., bash, powershell, python) or network utilities (e.g., curl, wget, netcat, nmap). This behavior is highly suspicious as the Splunk daemon should not typically invoke shells or network tools, and may indicate exploitation of the Splunk environment, lateral movement, or unauthorized task execution.
This rule detects a remote interactive logon (Logon Type 10) via RDP, followed by a PowerShell process executing 'net.exe' with sensitive administrative arguments such as 'administrator', '/active:yes', or '/dom'. This pattern is highly indicative of an adversary attempting to elevate privileges or modify domain/local account properties after establishing initial access via Remote Desktop.
Page 427 of 976