Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of Python or Pip utilities as parent processes to spawn potentially malicious binaries such as cmd.exe, powershell.exe, curl.exe, or rundll32.exe. This activity is often associated with the execution of downloaded payloads or shell commands directly through package manager workflows.
This rule detects suspicious process lineage where Python (python.exe or pip.exe) is initiating the execution of Windows command shell (cmd.exe) or Windows calculator (calc.exe). This pattern is often associated with exploitation of malicious Python site-hook files or similar techniques where a Python environment is leveraged to spawn secondary processes, potentially leading to unauthorized command execution.
This rule detects potentially malicious command execution patterns where a Python interpreter (python.exe) is invoked with the '-m' flag to execute a module, which subsequently spawns a command shell (cmd.exe) as a child process. This behavior is often associated with adversary attempts to leverage Python's capabilities for system interaction, payload execution, or lateral movement, as documented in various campaigns that abuse Python as a living-off-the-land binary.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
Detects reconnaissance and persistence behaviors associated with the Akira ransomware attack chain, specifically the execution of the Cloudflare Tunnel daemon for remote access or the creation/modification of local user accounts via standard Windows tools.
Detects a multi-stage attack chain where an AI-agent's configuration file (e.g., mcp.json) is modified, followed immediately by the execution of a tool process (node/python) spawned by the agent, the subsequent spawning of a shell process, and finally an outbound network connection to a rare, non-standard domain. This sequence is indicative of AI agent tool poisoning, where malicious tool definitions are introduced to execute arbitrary commands and exfiltrate data. Coverts T1195.002, T1565.001, T1059
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.
Detects the execution of PowerShell from web browser parent processes (chrome, edge, firefox, iexplore) using obfuscation techniques (hidden window, encoded command, no profile) combined with an indicator of WebDAV access (DavWWWRoot), which is commonly used to execute payloads from remote network shares.
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
This rule detects the use of 'mshta.exe' to execute HTML (.html, .htm) or MHTML (.mhtml, .mht) files. This behavior is often associated with bypassing Mark-of-the-Web (MotW) protections, as attackers may use container formats to deliver files that do not properly inherit MotW markings when extracted, allowing them to be opened by 'mshta.exe' without restrictive security policies.
Detects execution of a renamed Python interpreter (python.exe, ipy.exe, ipy64.exe) from suspicious locations (e.g., Temp, Downloads) or when launched by common web browsers and shell processes. This behavior is indicative of an adversary attempting to execute malicious scripts while masquerading as a legitimate process to evade detection.
FileFix (mr.d0x, June 2025) tricks victims into pasting a clipboard payload into the File Explorer address bar; explorer.exe directly spawns the hidden shell command with no legitimate GUI file-open lineage.
FileFix execution via the Explorer address bar writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths, a forensic artifact distinct from the Run dialog's RunMRU key, immediately before the malicious child process spawns.
FileFix lures append a real-looking file path after a '#' comment character so the Explorer address bar visually shows a benign path while the PowerShell prefix executes silently.
Once a FileFix chain succeeds, StealC and related loaders commonly establish Run/RunOnce persistence to survive reboot shortly after or before exfiltration.
The FileFix StealC campaign's final-stage loader is written in Go and performs VM/sandbox checks plus string encryption before executing the infostealer.
A documented FileFix variant arrives as an HTML/MHTML email attachment styled to look like a Word document or PDF, displaying a fake 'file could not be rendered' prompt that leads into the address-bar paste.
Detects mshta.exe spawning suspicious child processes (cmd.exe, powershell.exe, or reg.exe) that are characteristic of the ReverseRAT backdoor. The rule identifies common discovery commands or persistence attempts via Registry Run keys triggered from mshta.exe.
Page 70 of 976