Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,864
5,883
5,163
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects potential malicious activity where the 7-Zip utility spawns executable files or scripts. It monitors for child processes such as .exe, .js, .vbs, .ps1, or .bat files being executed from common user-writable directories (e.g., Downloads, Temp, Desktop). This pattern is often indicative of an adversary using a legitimate archive tool to extract and execute a malicious payload delivered via phishing or other initial access methods.
Detects indicators of execution related to a known NPM Remote Access Trojan (RAT), including masquerading via chost.exe, execution from specific temporary directories used by the malware, and Python scripts executing a loader.py file from temporary locations.
Detects indicators of active exploitation or malicious activity targeting the Flowise application. The rule triggers on the creation of a 'flowise_marker.txt' file, the spawning of node processes with suspicious command-line flags ('--require', 'node_options') potentially intended to bypass security controls, and the execution of unexpected shell or scripting processes (cmd, bash, python, etc.) by a Flowise process.
Detects execution of MyBB exploitation scripts, specifically targeting the 'mybb_limited_acp_to_admin' PoC, or evidence of a web server process (PHP) spawning suspicious shell or interpreter child processes, suggesting post-exploitation activity on a MyBB platform.
This rule monitors for the execution of known exploit scripts targeting MyBB forum software. It specifically detects the use of 'mybb_limited_acp_to_admin.py', as well as Python and PHP processes executing command lines that contain indicators of MyBB administrative control panel (ACP) exploitation, such as unauthorized user creation with administrator privileges (gid=4).
Detects execution of specific scripts or suspicious child processes indicative of a MyBB 'limited_acp_to_admin' exploit attempt. This rule looks for known script names related to the PoC and suspicious process lineage where a PHP web server process spawns command shells or scripting interpreters commonly used in post-exploitation activities.
This rule detects the execution of known exploit binaries and proof-of-concept (PoC) tools associated with vulnerabilities in libssh2, as well as anomalous child process spawning from common SSH-related applications (curl, git, php). These behaviors are indicative of exploitation attempts or unauthorized activity related to the libssh2 exploit chain.
Detects signs of active exploitation of the PHP857 vulnerability. The rule identifies suspicious behaviors associated with this RCE, including the spawning of shells by PHP processes, access to sensitive memory maps (/proc/self/) for ASLR bypass, and the creation of specific indicator files or execution of proof-of-concept strings.
Detects network share enumeration activity associated with Akira ransomware pre-deployment reconnaissance. The rule monitors for the execution of PowerShell PowerView cmdlets such as Invoke-ShareFinder, Find-DomainShare, and Get-NetShare, as well as the execution of the SoftPerfect Network Scanner (netscan.exe), including renamed instances staged in the ProgramData directory.
Detects unauthorized access to the Veeam Backup PostgreSQL database to extract credentials, a technique observed in Akira ransomware campaigns. The rule monitors for suspicious execution of psql.exe or PowerShell scripts designed to query the 'VeeamBackup' database for credentials, which are subsequently decrypted using DPAPI.
Detects the use of wbadmin.exe to initiate a system backup that targets sensitive Active Directory and registry files (NTDS.dit, SYSTEM, and SECURITY hives) to a local SMB share on the loopback address. This technique is used by threat actors to stage critical credential material for offline extraction and cracking.
Detects Vidar Stealer cloning a browser process (Chrome/Edge/Brave) using NtCreateProcessEx with a NULL SectionHandle to snapshot the browser address space for v20_master_key scanning as part of its Chrome Application-Bound Encryption (ABE) bypass chain.
This rule detects attempts to bypass User Account Control (UAC) using specific Windows executables (eventviewer.exe, fodhelper.exe, computerdefaults.exe, slui.exe) initiated by cmd.exe or powershell.exe. The rule specifically looks for these executables being run from non-standard system directories, indicating a potential UAC bypass technique often observed after an initial compromise, such as via RDP.
Detects the creation, execution, or deletion of Windows scheduled tasks using 'Mozilla' task names (specifically '\Mozilla\UpdateTask' or '\Mozilla\ElevateTask'). The rule identifies tasks created with SYSTEM privileges and 'ONSTART' triggers via schtasks.exe, as well as associated administrative commands to run or delete these tasks, and correlates these with Security Event ID 4698.
This rule detects a multi-stage attack sequence where a user is subjected to a 'spam bomb' (large volume of inbound emails in a short time), followed by an external Microsoft Teams contact, and concluding with the execution of legitimate remote support tools (Quick Assist or MSRA) on the victim's endpoint, which is a common pattern for social engineering and technical support fraud.
Detects privilege escalation events (assigning special privileges or executing privileged operations) occurring on a host shortly after the execution of legitimate remote support tools such as Quick Assist or msra.exe. This pattern is consistent with social engineering campaigns where attackers gain remote access via support tools and then perform local privilege escalation.
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Detects the execution of forced system shutdown commands (shutdown -s -t 0) initiated via cmd.exe or PowerShell. This behavior is often observed in post-compromise scenarios, including the TonRAT campaign, to disrupt system availability.
Detects the execution of a PowerShell script named 'cap.ps1' using common obfuscation and evasion flags including '-windowstyle hidden' and '-executionpolicy bypass'. This pattern is frequently used by adversaries to execute malicious scripts while minimizing user visibility and bypassing standard security policy restrictions.
Detects the execution of VBScript files (via wscript.exe or cscript.exe) where the parent process is a common web browser (Chrome, Firefox, Edge, or IE). This pattern is frequently indicative of a drive-by download or social engineering attack where a user is tricked into executing a malicious script originating from a web-based context.
Detects the creation of the 'MixedSvc' Windows service, which is used by DcRAT malware in Operation DragonReturn for persistence. The malware masquerades as 'Windows Mixed Reality Service' and sets the service's binPath to 'C:\Program Files\Windows Media Player\Mixed Reality.exe'.
Page 474 of 976