Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,864
5,884
5,164
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects execution of regsvr32.exe with flags indicative of the Squiblydoo application control bypass technique. The rule monitors for the use of the /i flag to load COM scriptlets from remote URLs (http/https) or UNC paths, or the inline loading of scrobj.dll, specifically in conjunction with the silent (/s) flag. Legitimate processes signed by Microsoft are excluded from detection unless remote URL execution is involved.
Detects the execution of rundll32.exe with arguments pointing to remote UNC paths, HTTP/FTP URLs, or local DLL files residing outside of standard, trusted Windows system directories (System32/SysWOW64). This behavior is indicative of an attempt to proxy malicious code execution, commonly associated with fileless or remote payload retrieval techniques.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Detects instances where PowerShell is invoked with an execution policy bypass flag to copy the 'curl.exe' binary from its legitimate System32 location to user-writable directories (such as AppData, Temp, or Public folders) and renaming it. This activity is often associated with adversaries attempting to evade security controls by masquerading legitimate system utilities.
Detects execution of a renamed pythonw.exe (userscreen.exe) from a suspicious location (Public\AccountPictures) that demonstrates short-lived execution characteristics indicative of a sandbox/VM evasion check, immediately followed by network connectivity to known NarwhalRAT C2 domains or pcloud infrastructure.
Detects signs of post-infection activity from the Amadey malware, specifically the unauthorized enabling of Remote Desktop Protocol (RDP) via registry modifications, the use of tscon.exe for session hijacking, unusual execution of RDP-related binaries (mstsc.exe, rdpclip.exe), and the deployment of legitimate remote access tools like AnyDesk or TeamViewer for lateral movement.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Detects potential exploitation of CVE-2026-8461 (PixelSmash) where an attacker hijacks the AVBuffer.free function pointer in media processing software (ffmpeg, ffprobe, etc.) to trigger arbitrary code execution via a spawned shell process.
Detects execution of the macOS 'security' utility to harvest generic or internet passwords from the Keychain, a technique commonly associated with the AMOS (Atomic macOS Stealer) infostealer for credential theft.
Detects the AMOS (Atomic macOS Stealer) infection chain where a shell (e.g., Terminal, bash) executes curl to download a DMG file to a temporary directory, followed immediately by the use of hdiutil with the -nobrowse flag to mount the disk image silently, effectively bypassing macOS Gatekeeper UI prompts to the user.
Detects automated lateral movement attempts using sshpass to perform password spraying or authentication against PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule specifically flags the use of sshpass with lax security settings (StrictHostKeyChecking=no), identifying a pattern associated with the uon_fanout.sh post-exploitation script.
Detects the execution of PowerShell scripts from the Windows Temp directory using common evasion flags (-NoProfile, -ExecutionPolicy Bypass, -WindowStyle Hidden). This pattern is consistent with loaders attempting to maintain persistence while obfuscating their execution context, specifically associated with steganographic malware campaigns.
Detects instances where the DonutLoader utility performs in-memory .NET payload execution. It identifies suspicious behavior by tracking the loading of clr.dll into a process that is not a recognized .NET host, concurrent with evidence of process hollowing techniques such as memory unmapping and process writing (NtUnmapViewOfSection, WriteProcessMemory, ResumeThread).
Detects the ClickFix social engineering technique where a user is coerced into copying and executing a malicious script from a web browser. The rule identifies instances where common web browsers spawn script interpreters such as powershell.exe, cmd.exe, mshta.exe, or wscript.exe, which is characteristic of the user pasting malicious commands into a command prompt interface.
This rule detects suspicious command-line activity indicative of a Remcos RAT loader attempting to establish persistence by copying or moving an executable (.exe) file into the AppData\Roaming directory. It specifically looks for 'cmd.exe' or 'powershell.exe' executing commands that contain both 'AppData\Roaming' or '%APPDATA%' and file manipulation commands ('copy', 'move', 'xcopy', 'REM') along with an '.exe' file extension.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
Detects execution patterns where security tools such as Microsoft Defender, Sysmon, and Filebeat are intentionally impaired or disabled using service control commands (sc.exe) and PowerShell cmdlets (Set-MpPreference), consistent with adversary activity aimed at bypassing security monitoring.
Detects the execution of bcdedit to configure the system boot into minimal safe mode. VECT ransomware uses this technique to evade security products on the next reboot.
Detects the execution of the NetSupport Manager remote access tool (client32.exe) when spawned by web browsers or script interpreters such as PowerShell or MSHTA. This behavioral pattern is frequently associated with malicious delivery chains including ClickFix and CastleLoader, where users are social engineered into downloading or executing suspicious payloads.
Detects attempts to disable Microsoft Defender security features. The rule monitors for PowerShell cmdlets (Set-MpPreference), service control operations (sc.exe stopping WinDefend), and registry modifications to the 'DisableAntiSpyware' policy key, which are common methods used by adversaries to impair host-based security defenses.
Page 461 of 976