Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the SHEETCREEP malware's melt function, which uses a hidden 'cmd.exe' process to forcibly delete executables. This is characterized by 'cmd.exe' spawning with a specific command line pattern involving 'choice /C Y /N /D Y /T 2' for a delay, followed by 'del /f /q' to delete an .exe file. The rule also looks for file deletion events of .exe files initiated by 'cmd.exe' outside of the C:\Windows\ directory with 'del /f' or 'del /f /q' in the command line.
This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.
Detects instances where OpenVPN Connect executables (OpenVPNConnect.exe, openvpn.exe) spawn shell interpreters or script hosts. This pattern is often indicative of exploitation or post-exploitation activities, as legitimate VPN client operation does not typically require the execution of cmd.exe, PowerShell, or script engines.
Detects instances where the Ghidra reverse engineering tool (via java.exe or javaw.exe) spawns suspicious child processes. This behavior is considered anomalous as Ghidra typically does not require launching command shells, scripting interpreters, or other system binaries directly from its process tree. Such activity often indicates that an attacker is using the Ghidra environment to execute secondary payloads or perform post-exploitation tasks.
Detects the execution of suspicious binaries spawned by the Windows script hosts (wscript.exe, cscript.exe) from the AppData directory. This pattern is indicative of the Grandoreiro banking trojan, which masquerades as an Adobe Reader update prompt and drops its payload into temporary folders to execute.
Detects potential exploitation attempts against Flowise by monitoring for suspicious child process creation. The rule flags Node.js processes spawned by Flowise that utilize case-insensitive command-line bypass patterns or reference suspicious environment variables, which may indicate an attempt to override security configurations through environment variable manipulation (e.g., node_options).
Detects the use of 7za to extract archives into the Avast Software directory, a behavior observed in Pay2Key ransomware campaigns to perform DLL hijacking for execution, persistence, or privilege escalation.
Detects the execution or creation of files named GT_NET.exe or Gt_net.exe, which are associated with the Grixba ransomware (Play Ransomware group). The rule also identifies files that masquerade as SentinelOne by utilizing SentinelOne-related product, company, or description metadata but are located outside of the legitimate SentinelOne installation directory.
This rule detects process execution where the command line contains specific strings commonly associated with process debugging, environment analysis, or exception handling (e.g., 'RtlGetCurrentPeb', 'timeBeginPeriod', 'gcstoptheworld', 'trace/breakpoint trap'). These artifacts are frequently observed in security research tools, malware analysis frameworks, or during the development of exploit payloads designed to interact with process memory or handle execution flow interruptions.
Detects execution of the 'fsutil' command with 'setZeroData' parameters in conjunction with a ping to 127.0.0.2. This pattern is commonly associated with malicious activities involving data manipulation or potential preparation for disk-level operations, as 'fsutil setZeroData' can be used to set a range of a file to zeros.
This rule detects potentially malicious attempts to escape a container or manipulate the host filesystem using the 'docker cp' command. It identifies commands that contain directory traversal patterns (e.g., '../', '..\') or direct references to the host filesystem via '/proc/self/root'.
Detects instances where the RustDesk remote access tool spawns suspicious child processes, such as command shells, scripting interpreters, or system administrative utilities. This pattern is often indicative of an adversary abusing legitimate remote access software to execute arbitrary commands, perform discovery, or maintain interactive control over a host.
Detects OS command execution spawned by a Java process, potentially indicating successful exploitation of Velocity template injection (e.g., in Flowise or Floci) where java.lang.ProcessBuilder is leveraged to execute malicious commands.
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
Detects instances where ImageMagick (convert, mogrify, magick, identify) attempts to execute Ghostscript or shell interpreters. The rule flags suspicious behavior such as spawning shell interpreters, using shell metacharacters or pipes in the command line, or executing Ghostscript from non-standard or potentially writable directory paths, which are indicative of a delegate hijack exploitation attempt for arbitrary command execution.
Detects potential unauthorized remote control activity via RustDesk, specifically identifying sessions that spawn child processes (e.g., cmd.exe, powershell.exe) or exhibit behavior indicative of bypassing permission constraints on RustDesk processes not signed by the official publisher.
Detects attempts to perform a container escape using the 'docker cp' command, where a maliciously crafted source path with traversal sequences allows the container daemon to write files outside of the container boundary. The rule monitors for suspicious 'docker cp' command executions and the creation of artifacts associated with known path traversal escape techniques in the host filesystem by the Docker daemon.
This rule monitors for the presence of known exploit harness binaries associated with CVE-2026-55200 on disk or in command lines, and identifies post-exploitation activity where common network utilities (curl, git, php) execute unsigned or suspicious child processes, which often indicates lateral movement or payload staging.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
Detects the execution of VBScript files via wscript.exe or cscript.exe from user-writable directories (Temp, Downloads, AppData, etc.) when the process is spawned by common application vectors like web browsers, email clients, or document viewers. This behavior is indicative of the Grandoreiro banking trojan's dropper mechanism, which uses obfuscated VBS scripts for geofencing and locale checks prior to downloading secondary payloads.
Detects potential DLL hijacking persistence by identifying modifications to registry values containing executable or library files that point to locations outside standard Windows system directories (System32 or SysWow64), subsequently joined with the execution of legitimate binary proxies known to be abused for side-loading like rundll32.exe or regsvcs.exe.
Page 475 of 976