Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,864
5,884
5,164
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the execution of specific utilities (e.g., 7zip components, socket modules) originating from a non-standard directory named 'AppData\Roaming\Traiolx Custom Utils'. This pathing pattern is indicative of potential malware staging or the execution of custom tooling in an attempt to masquerade as legitimate software.
This rule detects instances of the Python interpreter (python.exe) executing from the AppData\Roaming directory, which is a common persistence location for malware. It further correlates these process events with outbound network connections to external (non-private/non-RFC1918) IP addresses, identifying potential Command and Control (C2) or data exfiltration activity.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with suspicious command-line arguments, including references to batch files or execution from user-writable directories like AppData. This behavior is indicative of potential malicious payload execution or installation persistence attempts leveraging the msiexec utility.
Detects the LegionLoader infection chain, specifically identifying the use of dllhost.exe as a proxy to load malicious .cpl files or COM objects (e.g., COpenControlPanel) from AppData\Roaming. This rule correlates an initial msiexec.exe MSI staging event with the subsequent dllhost.exe execution and its child process spawn behavior within a 30-minute window.
Detects the creation of scheduled tasks using the 'schtasks' utility, initiated by suspicious parent processes (browsers, scripting engines, or common tools) or utilizing suspicious task actions (PowerShell, VBScript, etc.) in user-writable directories. Additionally, it flags tasks with high-frequency scheduling or persistence triggers paired with encoded or hidden command-line arguments, which are common indicators of malicious activity such as malware execution or persistence mechanisms.
Detects the execution of hidden shell scripts (.sh or .command) located within a mounted disk image (.dmg). This pattern is commonly used by macOS infostealers which masquerade as legitimate applications (such as Notion, Arc, or Raycast) to trick users into executing malicious code after mounting the deceptive installer.
Detects potentially unauthorized or suspicious child process execution originating from IDEs associated with Amazon Q/CodeWhisperer. The rule monitors for common shell execution (bash, sh, node) or AWS-related command-line activity that may indicate credential harvesting or exfiltration via IDE extensions.
Detects the execution of sensitive command-line tools or environment variables (e.g., AWS CLI, MCP tools, environment secrets) triggered by AI-based development assistants such as Claude, Cursor, or Windsurf. This behavior may indicate an attacker abusing the permissions or capabilities of an AI coding assistant to perform unauthorized cloud discovery or credential access.
This rule detects potentially suspicious host reconnaissance activities by monitoring for frequent execution of system information gathering utilities (reg.exe, wmic.exe, systeminfo.exe) or registry queries against HKLM software hives. It identifies users or hosts performing an anomalous volume of these activities, which is often indicative of post-exploitation discovery efforts.
This rule detects the presence of a specific malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd) in process command lines or file paths on Windows endpoints, originating from browser processes such as Chrome, Edge, or Brave.
Detects the execution of 'aws sts get-caller-identity' by common IDEs or code editor helper processes. This activity is often used by adversaries to verify the current AWS identity and permissions after gaining access to a developer's workstation.
Detects the use of Node.js package managers (npm, node, npx) to execute 'install' commands in conjunction with the creation of specific Model Context Protocol (MCP) configuration files (.vscode/mcp.json, .amazonq/mcp.json, or .cursor/mcp.json). This pattern may indicate the installation of potentially untrusted or malicious development extensions or AI-assistant integrations within common development environments.
Detects the execution of Lua interpreter binaries (LuaJit or lua) spawned from a specific process named 'HFY.exe', which is associated with the BeepRAT dropper. The rule also correlates this execution with suspicious raw disk read activity to identify potential in-memory payload loading or malicious interaction with system files.
Detects execution of potential BeepRAT shellcode loaders (tcc.exe or LuaJit.exe) using specific command-line arguments, as well as the creation of associated files (temp.bin, config.ini.c) or execution patterns initiated by HFY.exe.
Detects the execution of AWS STS 'get-caller-identity' commands via a network utility (curl) initiated by common development tools like VS Code, node, or amazonq-lsp. This behavior is indicative of potential cloud credential theft or reconnaissance performed through a compromised developer environment.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
This rule detects potentially malicious child processes spawned by Amazon Q or AWS Language Server components (e.g., amazon-q, aws-lsp-server). The rule specifically flags behavior associated with the loading of MCP server configurations, potential unauthorized access to AWS credentials, or network data exfiltration attempts through commonly abused binaries like shell interpreters, python, or curl/wget when these are not signed by Amazon.
Detects instances where common development runtime processes (e.g., node, python, shells) spawn child processes whose command lines contain references to sensitive credential environment variables such as AWS access keys, GitHub tokens, or SSH authentication sockets. This behavior often indicates that a developer or an automated tool is insecurely passing credentials via command-line arguments to subprocesses.
Detects the execution of AWS CLI commands by common scripting interpreters (Node.js or Python). This behavior is often indicative of automated cloud environment reconnaissance or credential testing using compromised access keys or instances.
This rule detects activities associated with the TaskWeaver JavaScript loader and its potential second-stage payload, Djinn Stealer. It monitors for JavaScript files (like jquery.js) being executed by Windows scripting hosts (wscript.exe, cscript.exe) or Node.js, identifies suspicious child process spawning behavior (e.g., cmd.exe, powershell.exe, system reconnaissance tools) from these scripting engines, and flags outbound network connections by these processes to common web ports that may indicate command-and-control (C2) communication.
Detects the execution of LuaJit.exe with a config.ini script, which acts as a Lua-based shellcode loader for BeepRAT. The loader uses Lua FFI to call Windows APIs such as VirtualAlloc and CreateThread to execute shellcode stored in temp.bin directly in memory. This pattern is indicative of fileless execution techniques employed by the BeepRAT remote access trojan.
Page 465 of 976