Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects suspicious activity originating from an OpenVPN process by correlating the creation of temporary files (common for dropped payloads) with the subsequent execution of shell interpreters (e.g., cmd.exe, powershell.exe, bash) within a 120-second window on the same host. This pattern suggests potential exploitation or post-exploitation activities where OpenVPN is leveraged to drop and execute malicious secondary tools.
Detects suspicious WMI queries to the SecurityCenter2 namespace for security product information (AntiVirusProduct, AntiSpywareProduct, FirewallProduct) originating from common web browsers or document editors. This behavior is indicative of the Grandoreiro banking trojan attempting to identify and evade security software.
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Detects suspicious WMI activities including the use of WMIC, PowerShell, and script hosts to perform enumeration of system configurations, installed antivirus products, or process listings. Additionally, it identifies suspicious child processes spawned by the WMI provider (wmiprvse.exe) such as cmd, mshta, or regsvr32. The rule uses behavioral thresholds (multiple WMI calls in 30 seconds) and identifies the execution of common analyst/security tools via WMI to flag potential reconnaissance or malicious execution.
Detects multiple concurrent attempts by a process to identify virtualization or analysis environments (sandbox evasion). The rule monitors for registry key lookups related to VMware/VirtualBox, as well as the execution of commands (via wmic, powershell, or tasklist) aimed at enumerating system information such as video controllers, boot times, operating system details, or process lists. An alert is generated when three or more distinct types of these checks are observed within a 60-second window by the same process, excluding administrative or system-level accounts.
Detects potentially unauthorized or suspicious usage of the RustDesk remote access tool. The rule monitors for connections from new peer IDs, the spawning of command shells (cmd.exe or powershell.exe) by the RustDesk process, and the writing of executable or sensitive file types by RustDesk to non-standard directories.
Detects a potential exploitation chain where 7-Zip is used to extract files from a RAR5 archive in a way that strips Mark-of-the-Web (MOTW) NTFS alternate data streams. The rule specifically monitors for 7z.exe launching with a .rar archive in the command line followed by the execution of potentially malicious files (executables, scripts, etc.) from user-writable directories shortly after.
This rule detects potential remote code execution (RCE) exploitation targeting PHP 8.5.7 via the StreamBucket SOAP deserialization vulnerability. It monitors for PHP-related parent processes spawning suspicious child processes (e.g., shells, network utilities, or specific exploit strings) that indicate unauthorized system command execution.
This rule detects malicious activity associated with the GIFTEDCROOK (UAC-0226) threat actor. It identifies the use of PowerShell or cmd.exe to execute staged files from specific ProgramData paths (WC3, wt1), monitors for common NT API-based reflective injection patterns (such as NtAllocateVirtualMemory and NtWriteVirtualMemory) originating from PowerShell, tracks the creation of known staging artifacts in ProgramData, and identifies the execution of known malicious process image hashes.
Detects instances where Claude AI-related processes (claude, claude-code) or Node.js processes associated with Claude launch suspicious commands or scripts such as setup scripts, base64-encoded commands, shell interactions, or external network connections. This behavior is indicative of potential supply chain compromise or malicious use of AI-assisted coding tools to execute arbitrary system operations.
Detects the KuinaExtractor UAC bypass technique, which exploits the auto-elevated 'SilentCleanup' scheduled task. The rule identifies suspicious activity via two patterns: the execution of 'cleanmgr.exe' from an unexpected parent process (bypassing normal task scheduler invocation) or the explicit execution of 'schtasks.exe' to trigger the 'SilentCleanup' task.
Detects reconnaissance behavior associated with the KuinaExtractor tool, identified by three or more distinct WMI hardware-related queries (CPU, disk, memory, etc.) executed within a 5-minute window by a non-administrative parent process.
Detects execution of PowerShell or PWSH containing multiple suspicious command line flags commonly associated with malicious scripts and evasion techniques, such as bypassing execution policies, running in hidden windows, using encoded commands, or utilizing invoke-expression.
Detects potential tampering with Windows Defender settings such as adding exclusion using wmic
Detects Node.js processes ('node' or 'node.exe') spawning other processes or executing commands that reference suspicious file paths, such as '.libcache.so' or '.sh.local', or utilizing risky syscall patterns like 'memfd_create' or 'fexecve'. This pattern is often associated with malicious npm post-install scripts or supply chain attacks.
This rule detects when the node.exe process initiates an outbound network connection to a specific set of non-standard, often high-numbered ports (8443, 8445, 8453, 5555, 56001-56003) over the public internet. This behavior is often indicative of potential command and control (C2) communication, reverse shells, or malicious scripts executing within a Node.js runtime environment.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects activity associated with a known malicious campaign involving 'Photo ZIP' themed lures. It identifies DNS queries to actor-controlled domains, the spawning of PowerShell by Explorer.exe with command lines referencing photo-related filenames or external file-sharing services, and the subsequent downloading of the node.exe runtime to user-accessible directories (consistent with TonRAT delivery).
Detects the use of the legacy OSQL.exe utility to connect to a local SQL server instance and execute a query that writes output to a file. This behavior is indicative of manual data discovery or exfiltration from a local database.
Detects the creation or modification of Windows Registry Run keys that point to potential Node.js applications or scripts. This is a common persistence technique where attackers configure malicious scripts to execute upon user logon or system startup.
Page 476 of 976