Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,482 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,168
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,482
11,866
5,884
5,164
4,867
Platforms
18,085
3,046
1,506
124
104
Products / Services
5,725
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects execution of the 'fsutil' command with 'setZeroData' parameters in conjunction with a ping to 127.0.0.2. This pattern is commonly associated with malicious activities involving data manipulation or potential preparation for disk-level operations, as 'fsutil setZeroData' can be used to set a range of a file to zeros.
This rule detects potentially malicious attempts to escape a container or manipulate the host filesystem using the 'docker cp' command. It identifies commands that contain directory traversal patterns (e.g., '../', '..\') or direct references to the host filesystem via '/proc/self/root'.
Detects instances where the RustDesk remote access tool spawns suspicious child processes, such as command shells, scripting interpreters, or system administrative utilities. This pattern is often indicative of an adversary abusing legitimate remote access software to execute arbitrary commands, perform discovery, or maintain interactive control over a host.
Detects OS command execution spawned by a Java process, potentially indicating successful exploitation of Velocity template injection (e.g., in Flowise or Floci) where java.lang.ProcessBuilder is leveraged to execute malicious commands.
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
Detects instances where ImageMagick (convert, mogrify, magick, identify) attempts to execute Ghostscript or shell interpreters. The rule flags suspicious behavior such as spawning shell interpreters, using shell metacharacters or pipes in the command line, or executing Ghostscript from non-standard or potentially writable directory paths, which are indicative of a delegate hijack exploitation attempt for arbitrary command execution.
Detects potential unauthorized remote control activity via RustDesk, specifically identifying sessions that spawn child processes (e.g., cmd.exe, powershell.exe) or exhibit behavior indicative of bypassing permission constraints on RustDesk processes not signed by the official publisher.
Detects attempts to perform a container escape using the 'docker cp' command, where a maliciously crafted source path with traversal sequences allows the container daemon to write files outside of the container boundary. The rule monitors for suspicious 'docker cp' command executions and the creation of artifacts associated with known path traversal escape techniques in the host filesystem by the Docker daemon.
This rule monitors for the presence of known exploit harness binaries associated with CVE-2026-55200 on disk or in command lines, and identifies post-exploitation activity where common network utilities (curl, git, php) execute unsigned or suspicious child processes, which often indicates lateral movement or payload staging.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
Detects the execution of VBScript files via wscript.exe or cscript.exe from user-writable directories (Temp, Downloads, AppData, etc.) when the process is spawned by common application vectors like web browsers, email clients, or document viewers. This behavior is indicative of the Grandoreiro banking trojan's dropper mechanism, which uses obfuscated VBS scripts for geofencing and locale checks prior to downloading secondary payloads.
Detects potential DLL hijacking persistence by identifying modifications to registry values containing executable or library files that point to locations outside standard Windows system directories (System32 or SysWow64), subsequently joined with the execution of legitimate binary proxies known to be abused for side-loading like rundll32.exe or regsvcs.exe.
This rule detects suspicious activity originating from an OpenVPN process by correlating the creation of temporary files (common for dropped payloads) with the subsequent execution of shell interpreters (e.g., cmd.exe, powershell.exe, bash) within a 120-second window on the same host. This pattern suggests potential exploitation or post-exploitation activities where OpenVPN is leveraged to drop and execute malicious secondary tools.
Detects suspicious WMI queries to the SecurityCenter2 namespace for security product information (AntiVirusProduct, AntiSpywareProduct, FirewallProduct) originating from common web browsers or document editors. This behavior is indicative of the Grandoreiro banking trojan attempting to identify and evade security software.
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Detects suspicious WMI activities including the use of WMIC, PowerShell, and script hosts to perform enumeration of system configurations, installed antivirus products, or process listings. Additionally, it identifies suspicious child processes spawned by the WMI provider (wmiprvse.exe) such as cmd, mshta, or regsvr32. The rule uses behavioral thresholds (multiple WMI calls in 30 seconds) and identifies the execution of common analyst/security tools via WMI to flag potential reconnaissance or malicious execution.
Detects multiple concurrent attempts by a process to identify virtualization or analysis environments (sandbox evasion). The rule monitors for registry key lookups related to VMware/VirtualBox, as well as the execution of commands (via wmic, powershell, or tasklist) aimed at enumerating system information such as video controllers, boot times, operating system details, or process lists. An alert is generated when three or more distinct types of these checks are observed within a 60-second window by the same process, excluding administrative or system-level accounts.
Detects potentially unauthorized or suspicious usage of the RustDesk remote access tool. The rule monitors for connections from new peer IDs, the spawning of command shells (cmd.exe or powershell.exe) by the RustDesk process, and the writing of executable or sensitive file types by RustDesk to non-standard directories.
Detects a potential exploitation chain where 7-Zip is used to extract files from a RAR5 archive in a way that strips Mark-of-the-Web (MOTW) NTFS alternate data streams. The rule specifically monitors for 7z.exe launching with a .rar archive in the command line followed by the execution of potentially malicious files (executables, scripts, etc.) from user-writable directories shortly after.
This rule detects potential remote code execution (RCE) exploitation targeting PHP 8.5.7 via the StreamBucket SOAP deserialization vulnerability. It monitors for PHP-related parent processes spawning suspicious child processes (e.g., shells, network utilities, or specific exploit strings) that indicate unauthorized system command execution.
This rule detects malicious activity associated with the GIFTEDCROOK (UAC-0226) threat actor. It identifies the use of PowerShell or cmd.exe to execute staged files from specific ProgramData paths (WC3, wt1), monitors for common NT API-based reflective injection patterns (such as NtAllocateVirtualMemory and NtWriteVirtualMemory) originating from PowerShell, tracks the creation of known staging artifacts in ProgramData, and identifies the execution of known malicious process image hashes.
Page 476 of 976