Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of the Windows 'attrib.exe' utility to set the hidden (+h) attribute on files or directories within 'ProgramData' or 'AppData' paths. This behavior is frequently associated with the Mustang Panda threat group to conceal malicious artifacts, such as the SHARDLOADER and ZOHOMURK implants, from standard user visibility.
Detects the creation of scheduled tasks using schtasks.exe that involve paths associated with staging (ProgramData, Temp, AppData) or are spawned by suspicious processes like Solid PDF Creator or MediumInstStart. This behavior is indicative of ransomware implant staging or persistence mechanisms used by threat actors.
Detects the MINIRECON implant performing reconnaissance activities, including sensitive directory listing and system information gathering. The rule monitors specific sideloaded process names such as 'pcl2bmp.exe' or 'Project Proposal.exe' as they execute discovery commands like 'dir /s', 'systeminfo', 'ipconfig', and 'whoami'.
Detects potential abuse of Active Directory Web Services (ADWS) by identifying the execution of known tools like SharpADWS or suspicious network connections to ADWS port 9389 by non-standard processes. The rule monitors Sysmon process creation and network connection events for keywords related to Active Directory web enumeration.
Detects instances where development IDEs (VS Code or Cursor) spawn suspicious child processes such as command shells (cmd, powershell, bash) or network utilities (curl, wget). The detection logic focuses on common command line patterns associated with IDE tasks or potential malicious activity.
This rule monitors for known malicious activities associated with a specific Go-based backdoor. It detects network connections to a known command-and-control IP (81.177.215.15) on port 9443, as well as host-based behaviors including suspicious WMI-based system information discovery and the execution of cmd.exe spawned by a specific suspicious process named MediumInstStart.exe.
Detects the use of built-in Windows administrative utilities (icacls, cacls, takeown, attrib) to modify file permissions or attributes. This behavior is commonly observed during the staging phase of The Gentlemen ransomware attacks to restrict user access to files or hide malicious payloads prior to encryption.
Detects suspicious executions of Python interpreters or Pip package managers originating from common development tools (like VS Code or Node.js) or utilizing temporary file paths. The rule also monitors for suspicious command-line arguments that indicate obfuscation, encoded payloads, or the use of dynamic evaluation functions.
Detects indicators of Mustang Panda activity, specifically identifying the loading of known malicious side-loaded DLLs (SolidPDFCreator.dll, ctxmui.dll) or anomalous process behavior originating from staging directories (e.g., \ProgramData\IDM\logs\) and binaries (MediumInstStart.exe, pct2bmp.exe) that interact with common system or browser processes.
Detects execution of a Python runtime loading a compiled bytecode file disguised with a '.cat' extension, a key defense evasion technique of NarwhalRAT.
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe, a technique used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
This rule detects the creation of user namespaces on Linux systems by unprivileged users. The 'unshare' command with '--user' or '-U' flags allows a process to move into a new user namespace, which can be abused for privilege escalation or container escape. The rule specifically excludes common container runtimes and processes running as 'root' to reduce false positives.
Detects use of Linux extended attributes to hide malicious data
This rule detects a sequence of events indicative of ransomware deployment following a successful Remote Desktop Protocol (RDP) connection. Specifically, it looks for an inbound RDP connection (RemotePort 3389) to a device, followed within 60 minutes by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') on the same device. This pattern suggests an attacker gaining initial access or moving laterally via RDP and then deploying ransomware.
Detects suspicious child processes spawned by 7-Zip components.
Detects when a known OpenClaw AI agent process spawns a shell to download and immediately execute a script. This is a common pattern used by malicious "Skills" to establish persistence or run further payloads, as detailed in the NSFOCUS report.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
This rule detects the execution of suspicious processes ('servertool.exe' or 'encrypt.exe') within 60 minutes of an inbound RDP connection being accepted on a device. This could indicate an adversary establishing remote access and then deploying tools for further compromise, such as data exfiltration or encryption for ransomware.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Detects the execution of 'opsec_enum.sh', a post-exploitation cleanup script, and associated activity involving ZipSlip-based webshell persistence components (such as 'mkzip34.py' and specific chunked file names) used by the threat actor MexicanMafia during Operation Escaneo.
Page 467 of 976