Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the task configuration is fetched from a remote XML file (HTTP/HTTPS URL). This pattern is often used by adversaries to download and execute malicious payloads via task scheduling, bypassing local file restrictions.
Detects a suspicious process chain where a web browser spawns the Windows Explorer process (typically representing a file dialog) which then immediately spawns a command interpreter (cmd.exe, powershell.exe, or mshta.exe). This pattern is consistent with ClickFix or similar attacks where a user is tricked into pasting a malicious command into a browser-triggered file selection window address bar.
FileFix loader chains abuse trusted code-hosting platforms like Bitbucket/GitHub to host staged payload components, exploiting domain trust to evade network detection.
Detects the execution of bash commands that contain base64 decoding flags, typically used to obfuscate command-line arguments to evade detection, initiated from a terminal application.
This rule detects two suspicious behaviors: 1) Execution of common system binaries (e.g., rundll32.exe, powershell.exe) from a directory pattern resembling a temporary folder or droppers, and 2) Network connections initiated by the 'attrib.exe' binary, which is atypical for this utility and may indicate malicious activity or staging.
Detects suspicious execution patterns on macOS where the Terminal application launches a bash process executing base64-encoded commands. This behavior is indicative of the ClickFix campaign, where users are prompted to copy and paste malicious obfuscated scripts into the terminal, often under the guise of a reCAPTCHA verification.
Detects the modification of AI agent configuration files (e.g., mcp.json, config.json) followed shortly by the agent spawning a child process that matches typical Model Context Protocol (MCP) server execution patterns. This behavior may indicate an attacker has modified the configuration to inject malicious server commands or tools that the AI agent will execute upon next initialization, effectively achieving persistent code execution via the agent's legitimate functionality.
Detects anomalous behavior where a node.exe process establishes an outbound network connection, characteristic of a C2 registration or ping loop, followed shortly by the spawning of an interactive command shell (cmd.exe or powershell.exe) by the same node.exe process. This pattern is indicative of a RAT (Remote Access Trojan) shell handler execution.
This rule correlates events across the end-to-end kill chain of an enterprise intrusion, specifically tracking the progression from initial endpoint-based infostealer activity (credential access), through anomalous or non-interactive sign-in activity, into privilege escalation or mailbox delegation within the cloud environment, and finally to mass data exfiltration or mail access. It detects accounts involved in at least three distinct stages of this progression within a 72-hour window.
This rule detects the installation or execution of common Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop, TeamViewer) on Windows endpoints within a 4-hour window of associated cloud identity risk activity (such as risky sign-ins, MFA changes, or privilege grants). It filters out legitimate activity initiated via standard software management pipelines (e.g., SCCM, Intune) to identify potential unauthorized use of remote access software by adversaries following account compromise.
Detects the use of common archiving utilities (7zip, WinRAR, Tar, or PowerShell Compress-Archive) to bundle sensitive Google Chrome user data, such as cookies, login data, or the entire user data profile directory. This behavior is indicative of an adversary attempting to stage sensitive information for exfiltration.
This rule detects the execution of common command-line cloud synchronization and file transfer utilities (such as rclone, rsync, and MEGAcmd) when invoked with flags or patterns indicative of data staging or exfiltration, such as copy, sync, or targeting remote cloud storage locations.
Detects instances of potential lateral movement using PsExec or WMI following an alert related to credential compromise, infostealers, or session hijacking, where the same user account is involved in both events.
Detects unauthorized non-browser processes attempting to access Chrome browser master keys or bypass App-Bound Encryption by interacting with the Chrome IElevator service, DPAPI routines, or the 'Local State' configuration file. This behavior is indicative of infostealer activity aiming to decrypt browser-stored session cookies and credentials.
Detects activity indicative of the 'ClickFix' social engineering technique, where users are tricked into manually executing obfuscated commands (often from fake CAPTCHA or error prompts) via the Windows Run dialog or command-line interfaces. The rule correlates suspicious process execution (e.g., mshta, powershell, certutil, curl) originating from explorer.exe with the detection of common encoded/obfuscated command line patterns, or interactions with the Windows RunMRU registry key, which logs commands typed into the Run dialog.
Detects the GitHub Actions runner executing the Bun runtime to run a hidden index.js payload, specifically associated with the compromised 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' actions. The rule filters for process execution context tied to GitHub runner internals and validates that the Bun execution follows the pattern observed in these supply chain attacks.
Detects the mounting of VHDX files via disk imaging tools or PowerShell, followed shortly (within 15 minutes) by the execution of a shell process with hidden window flags. This behavioral pattern is associated with the delivery of malicious payloads, such as those observed in Star Blizzard's RedFlick delivery chain for CosmicPulse.
Detects the creation of specific decoy scheduled tasks ('Internet Quality Test Connection', 'Network Configuration Manager', 'System Health Monitor') identified as part of the Star Blizzard actor's CosmicPulse delivery mechanism. The rule monitors for the creation of these tasks via schtasks.exe or system events, specifically when the task configuration references execution via rundll32.exe, regsvr32.exe, control.exe, or remote/UNC-based payloads.
Detects the startup or configuration of the WebClient service, commonly associated with WebDAV redirection, followed within 15 minutes by a process (e.g., control.exe, rundll32.exe, svchost.exe) interacting with a WebDAV-style UNC path. This behavioral pattern is indicative of attackers, such as the Star Blizzard group, abusing built-in Windows functionality to facilitate credential theft or remote file execution via malicious WebDAV shares.
This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.
This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.
Page 52 of 976