Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,884
5,164
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects web browsers and browser-related applications (e.g., Chrome, Edge, ChatGPT, Electron apps) spawning suspicious child processes that are commonly used for command-line execution or script interpretation. This behavior is often indicative of malicious extensions, browser exploits, or attempts to leverage browser processes for initial execution or lateral movement.
Detects JFMBackdoor activity where a sideloaded fltMC.exe executable located in a temporary directory initiates process enumeration using tasklist.exe or performs service lifecycle management operations (delete, start, stop, create, or query) using the sc.exe utility.
Detects host reconnaissance activity where the zlrenu8.exe process (associated with the NUKESPED backdoor/Kimsuky threat group) attempts to enumerate sensitive registry keys under HKLM\SOFTWARE and HKLM\SYSTEM. This behavior is indicative of post-exploitation discovery activities.
Detects the execution of WMI queries or hidden PowerShell commands initiated by JScript/VBScript interpreters (wscript.exe/cscript.exe), a behavior characteristic of Kimsuky's NUKESPED loader for performing anti-analysis and sandbox evasion.
Detects suspicious activity related to the OpenSSH server suite, including unauthorized modifications to core SSH binaries by non-package-manager processes, sshd processes writing files to temporary directories (a common indicator of credential harvesting), and sshd execution from non-standard file paths which may indicate a trojanized binary or persistence mechanism.
Detects process enumeration activities (tasklist, wmic, or command line process listing) performed by fltMC.exe. This pattern is characteristic of JFMBackdoor, which utilizes DLL side-loading through fltMC.exe to maintain persistence and perform situational awareness.
Detects instances where Windows NearShare or QuickShare utilities spawn child processes that are not part of their standard operational or helper suite (e.g., conhost.exe, WerFault.exe, svchost.exe). This pattern is often indicative of process injection, living-off-the-land techniques, or unauthorized activity masquerading as legitimate Windows sharing services.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects the execution of known PetitPotam exploitation tools or the use of command line arguments related to EFS RPC functions (e.g., EfsRpcOpenFileRaw) used to coerce authentication via NTLM reflection.
Detects unauthorized systemd service unit installation or modification, specifically targeting reverse shells or encrypted tunneling tools (e.g., gs-netcat, netcat) by monitoring systemctl commands referencing suspicious paths (/tmp, /var/tmp, etc.) that bypass standard package management workflows. This behavior is associated with the Velvet Ant threat group's persistence tactics on compromised Linux systems.
This rule detects instances where PowerShell is spawned by Windows Script Host processes (wscript.exe or cscript.exe) with suspicious command-line arguments indicative of fileless execution or payload decoding, such as the use of hidden windows, encoded commands, or certutil-based file decoding from the ProgramData directory.
Detects the execution of VS Code Tunnel processes (code-tunnel.exe or code.exe with tunnel arguments) initiated by processes other than standard development-related parent processes (e.g., explorer, terminal, IDEs). This behavior may indicate an adversary attempting to establish persistent unauthorized remote access to a compromised host using the VS Code Tunnel functionality.
This rule detects a multi-stage malicious activity pattern where a process performs system reconnaissance (process enumeration followed by network configuration enumeration) followed by an outbound network connection to a non-internal IP address. The rule uses transaction correlation on the ProcessGuid/ParentProcessGuid to link these distinct events into a single chain within a 2-minute time window.
Detects the execution of script files (e.g., .js, .jse, .vbs) via Windows Script Host (wscript.exe, cscript.exe) where the parent or grandparent process is a known archive extraction utility (e.g., 7zip, WinRAR). The rule further filters by identifying keywords associated with malicious lures (e.g., 'health', 'medical', 'nhis'). This behavior is commonly associated with phishing campaigns delivering malicious attachments.
This rule detects potentially malicious reconnaissance and execution activity. On Linux, it monitors for network and system information discovery utilities (e.g., ifconfig, netstat, ip) executed by shells or remote access daemons. On Windows, it monitors for the use of WScript, CScript, WMIC, and WBEMTest in potentially suspicious ways, including the use of WMI for command execution.
Detects execution of fltMC.exe from a location other than the standard Windows System32 directory, correlated with recent file creation or modification events in sensitive directories like ProgramData or User Public folders. This behavior is indicative of an attacker attempting to load malicious kernel-mode drivers or perform system-level operations using a renamed or moved system utility.
This rule detects two potentially malicious activities: the execution of 'fltMC.exe' from a 'Temp' directory, which is a known masquerading technique for the legitimate Windows filter manager utility, and the creation of an executable file within the 'C:\ProgramData\Windows Multimedia\ROG\' directory, which is a common path used by threat actors to stage malicious binaries.
This rule detects suspicious command-line execution originating from common web browsers. It identifies instances where a browser process launches a command-line interpreter (cmd, powershell, or wscript) and immediately invokes known download or utility commands (curl, iwr, bitsadmin, certutil), which is a common pattern for file-less or stage-two payload delivery from malicious websites.
Detects potential token manipulation attacks using SMB loopback connections. The rule identifies processes executing with privileges commonly associated with token impersonation (SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege) or running as SYSTEM that are not expected system processes, correlated with an SMB network connection to the local loopback address on port 445.
Detects unusual network connections or process creation events originating from the 'sharingd' daemon on macOS. 'sharingd' handles various Apple sharing features (AirDrop, Handoff, Shared Clipboard). Unusual child processes or network activity involving this daemon may indicate abuse for unauthorized data transfer, lateral movement, or remote service interaction.
Hunting rule for Atomic Red Team T1090.001 test "Connection Proxy" (Proxy: Internal Proxy). Correlate with additional signals before alerting.
Page 452 of 976