Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the presence or execution of known malicious Remote Monitoring and Management (RMM) tool binaries associated with phishing campaigns, such as those impersonating MSP360 or ScreenConnect.
Detects the execution of MSP360 or generic RMM-labeled binaries originating from common user download directories (Downloads or Temp folders) when the filename mimics common phishing lures such as invoice, e-card, RSVP, or document-related naming conventions. This activity indicates a potential social engineering attempt to execute remote monitoring and management tools.
Detects the presence or execution of known malicious Remote Monitoring and Management (RMM) tool binaries associated with phishing campaigns, such as those impersonating MSP360 or ScreenConnect.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
This rule detects potentially malicious command execution initiated by web browsers (Chrome, Edge, Firefox, Safari, Opera). It identifies scenarios where browsers spawn PowerShell on Windows with encoded command arguments or spawn shells (zsh, bash, sh) on macOS while piping commands retrieved via curl or wget, which is a common pattern for dropper and fileless malware delivery.
This rule detects potentially malicious activity involving LNK files being modified, created, or renamed in common locations (Desktop, Quick Launch, Start Menu) correlated with the creation of files ending in '.backup' within 30 minutes. It also independently detects the presence or execution of 'VLCAssistant.exe', which may indicate unauthorized launcher activity or masquerading.
Detects a specific pattern associated with AvisLoader or similar malware: a device establishes a network connection to known Cloudflare Tunnel infrastructure domains (trycloudflare.com or workers.dev), followed by the creation and execution of an executable file (.exe, .dll, or .scr) in user-writable directories such as Downloads, AppData, or Temp within a 15-minute window.
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that reference specific task names associated with potentially suspicious activity or persistence (e.g., PlutonAgentScheduler, EnterpriseMgmtServicesScheduler). The rule specifically looks for tasks being placed or modified within 'microsoft' or 'pluton' directories or paths, which may indicate an attempt to masquerade as legitimate system services.
Detects potential abuse of Windows Management Instrumentation (WMI) for process execution. It monitors for wmic.exe creating processes, PowerShell cmdlets Invoke-WmiMethod or Invoke-CimMethod used for remote execution, and unexpected process spawns from the WmiPrvSE.exe provider service, which are common indicators of lateral movement and remote command execution.
Detects the creation of WMI event subscriptions via wmic.exe, PowerShell, or the compilation of MOF files. These techniques are commonly used by adversaries to establish persistence or execute malicious payloads by binding event filters to event consumers.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell by identifying specific commands used to manipulate the AmsiUtils class or its field values in memory.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects the creation of Windows Management Instrumentation (WMI) Event Filter, Event Consumer, or FilterToConsumerBinding objects. Attackers use these objects to create event subscriptions that trigger malicious code or scripts upon specific system events, providing a stealthy and persistent execution mechanism.
Detects potential persistence attempts via registry modifications involving rundll32.exe. The rule monitors for two patterns: registry keys associated with shell commands for specific file types triggering rundll32.exe, and registry 'Run' keys using a 'Locked' value name with a custom URI handler, often indicative of malware or suspicious persistence mechanisms.
Detects command-line activity indicative of DNS tunneling, often used by OilRig (APT34) for C2 communication via BONDUPDATER. The rule monitors PowerShell or nslookup commands executing DNS TXT record queries paired with long, base64-encoded subdomains, a technique used for exfiltrating data or receiving commands.
Detects rapid, multi-category system and network enumeration performed by AI-assisted development tools (e.g., Cursor, Claude, ChatGPT). The rule triggers when an AI agent process performs a comprehensive scan of the host environment, specifically covering machine/OS identity, network configuration, process listings, installed software, and access to sensitive credential files within a 10-minute window. It requires at least 5 distinct discovery categories and 6 total events to reduce noise from routine debugging. Covers T1082, T1016, T1057, T1518
Page 85 of 976