Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects IronWorm rootkit activity on Linux, specifically focusing on cases where npm or node processes spawn tools like bpftool, insmod, or modprobe to load eBPF programs or kernel modules. It also flags the usage of specific IronWorm-associated filenames (q2.bpf, libbpf) within directories managed by npm or node.
Detects BQTLock ransomware (BaqiyatLock) establishing persistence by creating scheduled tasks via schtasks.exe. The detection monitors for scheduled task creation commands initiated by the ransomware payload (BQT.exe) or its loader (start.exe), specifically targeting tasks that execute files from high-risk paths like AppData or Temp, or directly reference BQT.exe.
Detects the execution of known Command and Control (C2) frameworks such as Sliver, Havoc, SparkRAT, or VShell from common suspicious temporary or staging directories (temp, tmp, appdata, programdata). This rule monitors process creation events to identify the presence of these unauthorized remote access tools.
Detects the use of BPF syscalls by non-root processes or the execution of BPF-related utilities (bpftool, bpfcc) from an interactive shell. This behavior is often associated with the ShadowGuard rootkit and potential BPF-based backdoor activity, which leverages BPF programs for stealthy system monitoring or command execution.
This rule monitors for two distinct behaviors: direct modification of Group Policy Object (GPO) containers within Active Directory and suspicious execution of GPO management tools (gpupdate.exe or gpedit.msc) across multiple hosts in a short timeframe. AD modification events are flagged as critical, while elevated tool execution patterns are flagged as high or medium risk based on host prevalence.
This rule detects the creation of scheduled tasks that are configured with high-privilege execution levels (SYSTEM or highest) or that reference suspicious file paths and filenames commonly associated with persistence mechanisms or VM image masquerading (e.g., QEMU files, .qcow2, vault.db). It monitors both command-line execution of schtasks.exe (Sysmon Event ID 1) and Task Scheduler configuration events (Windows Event ID 4698).
This rule monitors for suspicious Linux kernel operations, including the loading of BPF programs via bpftool or system calls, and attempts by debugging or tracing tools to interact with processes using forceful termination signals. It also includes an anomaly detection branch that identifies processes with active network connections that are missing from the system process list, which may indicate process ghosting or hiding techniques.
Detects the execution of VS Code Tunnel processes (code-tunnel.exe or code.exe with tunnel arguments) initiated by processes other than standard development-related parent processes (e.g., explorer, terminal, IDEs). This behavior may indicate an adversary attempting to establish persistent unauthorized remote access to a compromised host using the VS Code Tunnel functionality.
Detects the creation of scheduled tasks using schtasks.exe that reference specific QEMU binaries, the 'TPMProfiler' task name, or suspicious disk image file extensions (vault.db, bisrv.dll, custom.qcow2). This activity is associated with GOLD ENCOUNTER, STAC4713, and STAC3725, who use QEMU-based virtual environments for defense evasion and persistence.
Detects the execution of QEMU emulator binaries (qemu-system-x86_64.exe, qemu-system-i386.exe, qemu.exe, qemu-img.exe) on a Windows host. This activity is associated with threat campaigns attempting to spawn hidden guest virtual machines to evade detection mechanisms and potentially stage ransomware or other malicious payloads.
Detects evidence of final-stage PayoutsKing or 3AM ransomware deployment by identifying the execution of shadow copy or backup catalog deletion commands on a host where the QEMU virtualization process is simultaneously active, indicative of ransomware activity following lateral movement via VM-based techniques.
Detects a suspicious execution chain where a PyInstaller-compiled loader named 'start.exe' spawns 'BQT.exe', which is the identified payload for the BQTLock (BaqiyatLock) ransomware. The rule monitors for process launch events where these specific filenames appear in a parent-child process relationship.
Detects miner binaries and watchdog scripts associated with the CVE-2026-33017 Langflow cryptominer campaign being staged in hidden directories under /var/tmp, specifically /var/tmp/.xlamb/ and related files used to evade detection. The rule looks for file events or process events where the folder path or file name matches known indicators like '/var/tmp/.xlamb', '/var/tmp/init_rmount', 'lambsys', 'lambsys.elf', or 'init_rmount', or if the process command line contains these paths/filenames.
Detects instances where 'node.exe' accesses browser extension LevelDB directories for Chrome, Edge, or Brave, or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior can indicate attempts to exfiltrate sensitive browser data or establish persistence, potentially associated with supply chain attacks or backdoors.
Detects the unauthorized exfiltration of SSL private key files using Netcat to a known malicious C2 IP address (62.171.185.97). The rule monitors process execution commands that include specific file names associated with certificate harvesting or extraction tools being piped or transmitted over the network.
Detects instances where wscript.exe spawns a child process of itself with the /elevated command-line flag, a behavior often indicative of attempts to bypass User Account Control (UAC) or gain elevated script execution privileges.
Detects execution of tools and scripts known for exploiting the Zerologon (CVE-2020-1472) vulnerability, including zerologon_tester.py, zerologon.py, and Impacket-based Netlogon authentication abuse. The rule monitors command-line activity for these indicators, excluding processes signed by Microsoft.
Detects unauthorized attempts to access or dump credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule monitors for execution of known credential-dumping tools (e.g., secretsdump), cross-process access to lsass.exe, suspicious process command-line arguments (e.g., comsvcs, MiniDump), and the creation of files indicative of credential theft (e.g., lsass.dmp, wceaux.dll).
Detects the execution of portable Impacket tools ('mini_imp'), including psexec.py, secretsdump.py, and ntlmrelayx.py. This activity is indicative of potential credential harvesting, remote service execution, or NTLM relay attacks, as observed in the MexicanMafia 'Operation Escaneo' campaign.
This rule correlates a sequence of suspicious activities on a single host within a 24-hour window, indicating a multi-stage intrusion typically associated with ransomware campaigns. The detection chain includes initial credential harvesting (using tools like Impacket, BloodHound, or potential agent drops), followed by defense dismantlement (deleting shadow copies, terminating security processes, and disabling the firewall), and ending with system auditing/recovery sabotage.
Detects file creations (images), image loads, and process execution activity originating from or related to the 'SCef.WindowsAdapter' directory. This directory is often associated with specific third-party application behaviors and should be monitored for potential anomalous execution or staging of suspicious files.
Page 445 of 976