Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects anomalous file modifications to web-accessible directories (such as index.html, dist, public, or wwwroot) by common JavaScript execution environments including node.exe, bun.exe, or npm. This activity is consistent with post-compromise tampering of web assets as observed in the Miasma/Hades campaign, likely involving the abuse of stolen repository credentials to deploy malicious content.
This rule detects potential sandbox evasion or environment analysis by identifying multiple disparate system checks (hardware, memory, processor, analysis tool, or uptime checks) performed within a short timeframe by common script interpreters like PowerShell or WScript/CScript.
Detects potential persistence attempts via cron job manipulation by unprivileged service accounts (such as www-data) or patterns indicative of the 'lambsys' threat, including usage of known writable temporary directories, non-interactive crontab installations, and aggressive execution schedules.
This rule detects a multi-stage attack chain where a WinRAR or UnRAR process, spawned by an email client (Outlook or Thunderbird), extracts files directly into the Windows startup directory. It then correlates this with the execution of common scripting or command-line tools (such as mshta, wscript, powershell, or cmd) from that same startup location within 30 seconds of the extraction event.
Detects execution chains where Outlook launches a VBScript file that subsequently invokes PowerShell with encoded commands, characteristic of Gamaredon (ACTINIUM) threat activity. Additionally, it identifies the creation of VBScript/VBE files in temporary directories, which is consistent with the deployment of PteroVDoor or PteroPSDoor loaders.
Detects instances where the WinRAR process (winrar.exe) spawns common script interpreters or command-line shells, including mshta.exe, wscript.exe, cscript.exe, powershell.exe, or pwsh.exe. This behavior is often indicative of an adversary attempting to execute malicious code embedded in or extracted from a compressed archive.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Shutdown Button". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Detects the BQTLock malware's User Account Control (UAC) bypass technique. This technique involves modifying the registry key HKCU\Software\Classes\mscfile\shell\open\command to hijack the EventViewer COM object. Subsequently, eventvwr.exe is launched, which auto-elevates and executes BQT.exe, bypassing UAC.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
This rule monitors for the execution of the 'bun.exe' process specifically when it originates from a Node.js-related context (such as npm, node-gyp, or binding.gyp execution) or exhibits suspicious behaviors like executing payloads from /tmp directories. This pattern is often associated with supply chain attacks or malicious package execution within JavaScript development environments.
This rule detects the execution of Mimikatz via process name matching or the presence of known credential dumping command-line arguments (e.g., 'sekurlsa::logonpasswords' or 'privilege::debug'). These indicators are commonly used by adversaries to extract sensitive information like plaintext passwords or hashes from the LSASS memory process.
This rule detects PowerShell activity where commands are used to perform reconnaissance (e.g., whoami, ipconfig, or network group enumeration) and the output is exfiltrated or sent via a POST request to a specific external IP address (202.182.102.5).
Detects the download, staging, and execution of SoftEther VPN components associated with CL-STA-1062. The rule monitors for the creation of specific SoftEther files, network downloads from known actor staging infrastructure, and the execution of SoftEther binaries masquerading as VMware tools (vmtools.exe).
Detects the execution of the JuicyPotato privilege escalation tool, which exploits COM server permissions to escalate a lower-privileged account to NT AUTHORITY\SYSTEM. The rule monitors process creation events for known file names, command line patterns, and specific argument structures used by this tool.
Detects instances where svchost.exe (typically a system service host) is acting as the parent process to spawn reconnaissance utilities such as systeminfo.exe, wmic.exe, ipconfig.exe, or whoami.exe. This behavior is highly irregular as these utilities are typically invoked by users or administrative scripts, not system-level service processes, and may indicate process injection or malicious activity leveraging legitimate system processes.
Detects unexpected shell command execution spawned by the Amazon Q Developer VS Code extension processes (e.g., 'amazonq-lsp'). This activity is consistent with patterns related to the exploitation of CVE-2026-12957, involving the potential auto-execution of unauthorized commands via MCP (Model Context Protocol) server configurations or malicious inputs.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
Page 440 of 976