Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the DRAYN malware performing environment reconnaissance and sandbox evasion. It monitors for file access to the 'vmbusr.sys' driver, which is commonly used to identify virtual machine environments, followed by the execution of PowerShell commands to retrieve the system's UUID via Win32_ComputerSystem, a technique used for host fingerprinting.
Detects a sequence of actions often performed by the LCRYX ransomware, characterized by the suppression of Windows boot recovery settings via BCDEdit followed by the deletion of volume shadow copies (using vssadmin or wmic) or backup catalogs (using wbadmin), all executed from the same process within a 10-minute window.
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
This rule detects the execution of Impacket toolkit modules (such as psexec.py, wmiexec.py, secretsdump.py) via EDR process events, as well as potential lateral movement patterns identified by NTLM authentication (Logon Type 3) to ADMIN$ or IPC$ shares. This combination of signals is indicative of credential dumping, remote service execution, or lateral movement using techniques often employed by the Impacket suite.
Detects suspicious unprivileged process behavior associated with the exploitation of CVE-2026-43503 (DirtyClone). The rule identifies non-root users invoking 'unshare' or 'clone' with namespace-related flags (CLONE_NEWUSER, CLONE_NEWNET), followed by critical writes to namespace mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) which are prerequisite steps for elevating to CAP_NET_ADMIN privileges.
This rule detects potentially malicious shell execution (e.g., bash -i, /dev/tcp/ reverse shells, netcat) spawned directly or indirectly by common media processing applications such as ffmpeg, ffprobe, jellyfin, or nextcloud. It identifies when these applications initiate shell processes or execute command lines that exhibit suspicious behavior or access specific media-related paths commonly targeted for abuse.
Detects execution of the Microsoft Connection Manager Profile Installer (cmstp.exe) when initialized with an INF file from potentially suspicious directories (e.g., Temp, AppData), or when cmstp.exe is observed spawning common command-line shells (cmd.exe, powershell.exe) or rundll32.exe, which is indicative of potential proxy execution or UAC bypass techniques.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
Sshpass Lateral Movement
YARA-L
Detects sshpass automation usage by administrative accounts
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects the execution of Ghostscript (gswin64c.exe) by ImageMagick (magick.exe or convert.exe), where the binary location does not appear to be a standard installation path. This behavior is a common indicator of exploitation attempts against ImageMagick vulnerabilities, such as ImageTragick or subsequent Ghostscript-based file processing exploits.
This rule detects processes that are not common browsers (chrome, msedge, firefox, etc.) initiating a network connection over the STUN protocol (UDP port 3478) while simultaneously running with a command-line argument containing '--kiosk'. This pattern often indicates potential command-and-control (C2) communication or unauthorized network traversal disguised as normal traffic from kiosk-mode applications.
Detects indicators of exploitation attempts targeting the c-ares asynchronous DNS library, specifically focusing on Use-After-Free (UAF) vulnerabilities. The rule monitors for the presence of known proof-of-concept (PoC) file artifacts, execution of processes using specific command-line flags associated with c-ares exploit research, suspicious shell/calculator spawning from common network-enabled applications (curl, node, python), and anomalous high-frequency DNS-over-TCP traffic patterns.
Detects the execution of VBScript processes (wscript.exe/cscript.exe) that interact with WMI to enumerate installed antivirus products or perform external IP geolocation lookups via services like ip-api.com. This behavior is indicative of the Grandoreiro banking trojan performing environment reconnaissance and victim-targeted execution.
Detects potential exploitation attempts targeting the Flowise 3.1.2 Custom MCP (Model Context Protocol) stdio interface. The detection monitors for the bypass of environment variable validation where lowercase 'node_options' is used to circumvent security controls blocking 'NODE_OPTIONS', potentially allowing unauthorized code execution via '--require'. It also alerts on the presence of associated PoC artifacts and anomalous outbound network activity from Flowise processes.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically focusing on DLL side-loading from user-writable directories (AppData, Temp, Downloads) and the execution of randomized executables spawned by wscript.exe, which is characteristic of its VBS dropper mechanism.
Detects the presence and execution of the 'mybb_limited_acp_to_admin' PoC script, as well as suspicious child process creation originating from web server or PHP processes when the command line includes 'admincp'. This is indicative of potential web exploitation or the use of a web shell within the MyBB Administrative Control Panel environment.
Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.
This rule detects activity associated with known Android Remote Access Trojans (RATs) such as BTMOB, CraxsRAT, CypherRAT, and SpySolr on SentinelOne-managed Android devices. It flags suspicious file creations (sideloaded APKs in user storage), specific malicious process names, SentinelOne threat indicators, and abuse of accessibility services for unauthorized remote control, keylogging, or screen overlay activities.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Page 433 of 977