Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects PsExec used for remote command execution in lateral movement
Detects UAC bypass using ICMLuaUtil COM object elevation
Detects Rundll32 used to execute arbitrary DLL code
Detects instances where common administrative tools (such as PowerShell, cmd, or network utilities) are launched as child processes of the WinRM service process (wsmprovhost.exe) shortly after an inbound WinRM network connection is established on port 5985 or 5986.
Detects instances where common administrative tools (such as PowerShell, cmd, or network utilities) are launched as child processes of the WinRM service process (wsmprovhost.exe) shortly after an inbound WinRM network connection is established on port 5985 or 5986.
Detects the use of common PowerShell cmdlets often associated with fileless malware execution, such as 'Invoke-Expression', 'IEX', or 'DownloadString', initiated by 'powershell.exe'. These patterns are frequently used to download and execute malicious payloads directly in memory, bypassing traditional disk-based scanning.
This rule detects the execution of potentially malicious processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe) initiated by mmc.exe or explorer.exe, excluding known legitimate Microsoft Management Console (MMC) flags and common management snap-ins. This pattern is indicative of potential proxy execution or misuse of system administration utilities to run unauthorized code.
Detects AnyDesk remote desktop used as persistent unauthorized C2 channel
Detects the initial ClickFix mechanism where a user is socially engineered into pasting a malicious script (Get-Clipboard) into the Run dialog (explorer.exe), which launches PowerShell to fetch the CastleLoader.
Detects suspicious reconnaissance activity involving multiple common Windows discovery tools (nltest, net, dsquery, ipconfig, whoami, systeminfo) executed within a short time window (5 minutes) that was preceded (within 30 minutes) by a command shell (powershell.exe or cmd.exe) spawned by a web browser or common script-based execution engine (e.g., mshta.exe). This pattern is indicative of a post-exploitation phase where an attacker, having gained execution via a browser-based delivery method, performs environment discovery.
Detects usage of the Windows certutil.exe binary to perform potentially malicious operations such as downloading files via URL cache or decoding base64/hex payloads. The rule specifically alerts when these actions occur within common user-writable or temporary directories often used by threat actors for file staging.
This rule detects a sequence of suspicious activities: the creation or modification of an executable file (.exe or .dll) within a directory path containing update-related keywords, followed by the execution of a file in that same location, and culminating in an outbound network connection from that process. This pattern is characteristic of a software supply chain compromise or an adversary deploying a malicious payload via a fake or compromised update mechanism.
Detects suspicious execution of command-line utilities (cmd, powershell, pwsh) spawned by Windows Explorer (explorer.exe). The rule flags processes with long command lines or those containing evidence of obfuscation (Base64 encoding) or common command-line indicators used for weaponized scripts, such as download requests or expression invocation.
Detects the use of NTFS Alternate Data Streams (ADS) by monitoring process command lines, initiating process command lines, and folder paths for patterns indicative of ADS notation. The rule specifically flags potential execution or access patterns involving common script interpreters (wscript, cscript, powershell, pwsh) combined with ADS, as well as general ADS usage in file paths.
This rule detects the creation of .lnk files in common suspicious directories (such as startup folders, Temp, or Downloads) followed by the execution of common scripting or command interpreters (powershell.exe, mshta.exe, wscript.exe, cmd.exe) with long command lines within a 10-minute window. This behavior is often indicative of an adversary attempting to achieve persistence or execute malicious payloads via user interaction.
Detects the spawning of /bin/sh or /bin/bash as a direct child process of ffmpeg, jellyfin, or nextcloud. This behavior is often indicative of exploitation attempts against these media and storage services, potentially leveraging remote code execution vulnerabilities.
Detects unauthorized execution of MeshCentral's meshctrl.js to interface with a local WebSocket endpoint on PeopleSoft servers, likely indicative of session hijacking post-exploitation of CVE-2026-35273 by the ShinyHunters threat group.
Detects the unauthorized access of sensitive files (browser data, SSH keys, AWS credentials) followed by the creation of archives using common utilities (7zip, tar, zip) by processes spawned within npm/node.exe/powershell/wscript/chost.exe postinstall execution chains. This behavior is associated with credential theft and data staging for exfiltration, notably seen in campaigns like Operation Friday Harvest.
Detects the use of the Windows attrib.exe command with the +h (hidden) attribute flag applied to files within the AppData\Roaming or AppData\Local directories. This behavior is commonly associated with malware attempting to hide malicious components for persistence or evasion.
Detects the execution of the 'finger.exe' utility when initiated by common scripting hosts or command shells. The 'finger' utility is an antiquated network protocol often used by adversaries for network information or user enumeration. Its execution from within script interpreters is highly atypical and likely indicates malicious reconnaissance activity.
Page 438 of 976