Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects a suspicious sequence of adversary behaviors typically associated with pre-ransomware activity. The rule identifies high-volume SMB scanning (more than 20 unique IPs in 5 minutes) correlated with network share discovery (using tools like netscan.exe or PowerShell scripts such as Invoke-ShareFinder), and optionally links these actions to credential dumping events on the same host (LSASS dumping via comsvcs.dll or NTDS.dit exfiltration via wbadmin) within a 48-hour window.
This rule detects the deployment and execution of the RustDesk remote access tool in conjunction with potential staging of installation artifacts and observed prior activity related to BumbleBee/Adaptix C2. It correlates process execution, file creation, and network connectivity to the RustDesk relay infrastructure to assign a risk score, helping identify potential unauthorized remote access or malicious persistence.
Detects the execution of PowerShell with an encoded command flag when spawned directly from explorer.exe or cmd.exe. This pattern is frequently used in 'ClickFix' style attacks where users are tricked into copying and pasting malicious, obfuscated PowerShell code into the Windows run dialog or command prompt.
Detects the abuse of the legitimate Windows utility certutil.exe to download files or perform encoding/decoding operations. These techniques are commonly used by attackers to stage malicious payloads, obfuscate files to bypass security controls, or retrieve additional malware components in multi-stage loader chains.
Detects potential BaoLoader drive-by compromise attempts by monitoring two stages: first, the creation of executable files in temporary or application data directories by browser processes; and second, the execution of command-line shells by processes running from those same directories where the browser acted as the grandparent.
Detects instances where common web browsers (Chrome, Edge, Firefox, Brave) spawn command-line tools or script interpreters (cmd, PowerShell, wscript, mshta) as child processes. This behavior is highly indicative of drive-by download attacks, including the 'ClickFix' technique, where users are socially engineered into executing malicious commands under the guise of fake browser updates or error resolution.
Detects the execution of PowerShell with an encoded command flag when spawned directly from explorer.exe or cmd.exe. This pattern is frequently used in 'ClickFix' style attacks where users are tricked into copying and pasting malicious, obfuscated PowerShell code into the Windows run dialog or command prompt.
Detects the abuse of the legitimate Windows utility certutil.exe to download files or perform encoding/decoding operations. These techniques are commonly used by attackers to stage malicious payloads, obfuscate files to bypass security controls, or retrieve additional malware components in multi-stage loader chains.
Detects the execution of known Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Action1) from user-writable directories such as Temp, Downloads, or INetCache. Adversaries frequently utilize these legitimate remote access tools to establish persistence or command-and-control channels, often dropping them into temporary directories to avoid detection.
This rule detects a multi-stage loader chain behavior. Stage 1 identifies PowerShell spawning mshta.exe or wscript.exe, which is commonly used to execute malicious scripts or loaders. Stage 2 detects mshta.exe or wscript.exe subsequently executing schtasks.exe or wmic.exe with command-line arguments indicative of establishing persistence via scheduled tasks or WMI event subscriptions.
Detects network and process execution activity involving Google or Microsoft OAuth2 token endpoints from non-browser and non-trusted processes. This behavior is indicative of potential token theft or session hijacking attempts, where malicious tools (e.g., curl, python) are used to access authentication endpoints to bypass standard user interaction.
Detects potential remote code execution (RCE) attempts leveraging a vulnerability in the Nextcloud Movie preview provider (CVE-2026-8461). The detection identifies cases where the web server service user (www-data) unexpectedly spawns ffmpeg or ffprobe, followed by the immediate spawning of a command shell from these multimedia processing binaries, which is highly anomalous.
Detects the execution of a renamed Windows Address Book (WAB.exe) binary, observed as AdgNsy.exe, originating from an AppData local directory and spawned by WmiPrvSE.exe. This pattern is indicative of AdaptixC2 beaconing activity, leveraging WMI for execution to maintain persistence or conduct remote operations under the guise of a legitimate system utility.
Detects the installation of the Cloudflare Tunnel (cloudflared) utility as a Windows service, often used by threat actors to establish persistent, outbound command-and-control (C2) channels that bypass standard network perimeter controls. This rule monitors for PowerShell-based downloads from GitHub, silent MSI-based installation, and the execution of the 'service install' command.
Detects the execution of 'AdgNsy.exe', a known malicious masquerading process associated with the AdaptixC2 beacon, attempting to scan internal network infrastructure by initiating outbound connections to sensitive ports including SMB (445), RDP (3389), LDAP (389/636), and 9401. This behavior indicates internal reconnaissance for lateral movement.
Detects the Atomic macOS Stealer (AMOS) malware establishing persistence by creating a LaunchAgent plist file ('com.hlpr.agent.plist') and subsequently loading it using the 'launchctl' utility.
Detects execution of AryStinger or JDY malware as a secondary payload on Oracle PeopleSoft servers, likely following exploitation of CVE-2026-35273 by ShinyHunters. The rule monitors for processes matching these names or anomalous binaries spawned from within the PeopleSoft application directory that are not part of the legitimate application service suite.
Detects unauthorized usage of the 'osascript' command to interact with the 'security' binary on macOS, specifically targeting keychain operations such as dumping, finding generic passwords, or unlocking the login keychain. This behavior is indicative of Meow RAT attempting to exfiltrate credentials from the macOS Keychain or browser-stored secrets.
Detects the execution of known adversary-in-the-middle (AiTM) phishing frameworks, such as Evilginx or Modlishka, by identifying process names, paths, or specific command-line arguments (e.g., --phishlets, --proxy, --lure) used to initiate these proxy-based phishing sessions.
Detects evidence of the execution of a proof-of-concept (PoC) exploit targeting Next.js unstable_cache functionality. The rule monitors for the installation of canary versions of Next.js, execution of the PoC demonstration script 'run_demo.mjs', and the creation of a 'VULNERABILITY_CONFIRMED.marker' file, which are specific indicators associated with the exploitarium repository PoC.
Detects the creation of scheduled tasks using schtasks.exe where the task action executes a scripting engine or living-off-the-land binary (LOLBin). This behavior is often indicative of adversaries attempting to establish persistence or execute code using native system tools to evade detection.
Page 430 of 976