Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where PowerShell is spawned directly from Microsoft Teams processes or via explorer.exe shortly after receiving an external chat message in Teams. This pattern is often associated with social engineering lures, such as the 'paste-and-run' attack chain used to facilitate malicious activity.
Detects the spawning of suspicious shell processes (sh, bash, cmd.exe) by media processing applications like ffmpeg, ffprobe, jellyfin-ffmpeg, jellyfin, or nextcloud. This activity is often indicative of an adversary exploiting a vulnerability in these applications to gain initial access or execute arbitrary commands, potentially leading to further compromise. The rule specifically looks for suspicious command-line arguments that suggest interactive shells, network connections, or direct command execution.
Detects the OpenClaw AI agent process spawning shell interpreters (bash, sh, zsh) or network utilities (curl, python3) with command-line arguments indicative of base64-encoded payload execution. This behavior often suggests malicious markdown-based skill execution attempting to bypass sandboxing by the ClawHavoc threat actor.
Detects the execution of the 'whoami' command when it is base64 encoded in the process command line. This technique is often used by adversaries to discover system user information while attempting to evade simple string-based detections.
This rule detects Python spawning native OS command utilities such as 'systeminfo.exe', 'whoami.exe', and 'ipconfig.exe'. The detection logic specifically looks for at least two distinct reconnaissance commands executed by the same Python process within a one-minute window, indicating potential victim profiling for a C2 panel, as observed in OpenClaw campaigns.
Hunting rule for T1197 "Bitsadmin Download (cmd)". No public in-the-wild intel reference available; correlate before alerting.
Identifies file, registry, network, and process indicators associated with the @mastra/* npm supply chain compromise. This rule detects the presence of specific malicious files, registry modifications for persistence, outbound network connections to known command and control (C2) infrastructure, and the execution of malicious scripts related to the attack.
Hunting rule for Atomic Red Team T1490 test "Windows - Disable the SR scheduled task". Correlate before alerting.
Hunting rule for Atomic Red Team T1490 test "Windows - Disable the SR scheduled task". Correlate before alerting.
Detects signs of Grixba malware activity, including process execution of Gt_net.exe from the Public/Music directory, associated WMI/WinRM remote network connections, and the creation of staging artifacts such as data.zip or ExportData.db.
This rule monitors for suspicious activity linked to files or processes within the Windows temporary directory. It identifies three distinct malicious patterns: (1) sensitive privilege usage (e.g., SeDebugPrivilege) by processes running from temp; (2) presence of known malicious file names associated with a specific campaign (vile_*.ico, vile_*.lnk, etc.); and (3) PowerShell execution of a specific decryptor shortcut file from the temp directory.
Detects suspicious activity involving the combination of user or network namespace creation using 'unshare' or 'ip' and subsequent manipulation of kernel networking queues using 'tc' (Traffic Control). This behavioral pattern is frequently observed in Linux kernel exploits designed to achieve local privilege escalation by creating namespaces and using the 'tc' subsystem to trigger vulnerabilities. The rule further refines matches by flagging commands or parent processes residing in directories associated with staging or temporary storage, such as /tmp or /dev/shm.
Detects a potential privilege escalation attempt where an unprivileged user executes a SUID-capable binary (su, sudo, passwd), followed immediately by the creation of a root-owned shell process. This pattern is indicative of exploitation of local privilege escalation vulnerabilities, such as page cache poisoning (e.g., CVE-2026-46331).
This rule detects potentially malicious activity involving the 'nvdaHelperRemote.dll' library and suspicious parent-child process relationships. It identifies instances where a process named 'COU_ITR' spawns suspicious children (cmd, powershell, rundll32), or where 'nvdaHelperRemote.dll' is loaded from non-standard or user-writable directories (such as AppData, Temp, Downloads, or Desktop), which is indicative of DLL hijacking or side-loading techniques.
Detects the suspicious combination of 'aa-exec' (commonly associated with AppArmor or specific container runtime wrappers) being followed by the execution of 'unshare' with flags used to manipulate kernel namespaces (user, network). This pattern is often indicative of container breakouts or privilege escalation attempts where an adversary leverages namespace isolation to gain higher privileges on the host.
Detects when common developer environments (IDE processes like VS Code or Node.js-based tools) or AI coding assistant tools (e.g., Amazon Q) spawn suspicious child processes (like shells or network tools) that interact with sensitive cloud configuration files, environment variables, or initiate unauthorized network requests.
Detects the execution of the 'unshare' utility by non-root users with flags designed to create new user or network namespaces. This behavior is often associated with container escape attempts, privilege escalation, or efforts to bypass local security controls by creating isolated environments.
Detects evidence of the DirtyClone (CVE-2026-43503) Linux kernel privilege escalation exploit. The rule identifies a multi-stage attack chain, including the compilation of the exploit binary, creation of unprivileged user and network namespaces required for the exploit, and the use of the 'ip' utility to configure XFRM states/policies for page cache corruption.
Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.
Detects the execution of script interpreters (wscript.exe, mshta.exe, cscript.exe) where the parent process, process path, or command line originates from a removable drive (drive letters D: through Z:). This is a common pattern for USB-based malware propagation and execution.
Detects instances of node.exe spawning wmic.exe or powershell.exe to perform security software discovery. The malware uses WMI queries or registry enumeration to identify common security agents (e.g., CrowdStrike, SentinelOne, Defender) likely to determine if it is running in a monitored environment.
Page 439 of 976