Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects anomalous activity where AI assistant processes (e.g., Claude, ChatGPT, GitHub Copilot) execute a high volume of diverse discovery commands. The rule correlates multiple discovery categories, such as account, network service, system information, and network configuration discovery, occurring within a short timeframe to identify potential abuse of AI-integrated development tools for host reconnaissance.
Detects anomalous activity where AI assistant processes (e.g., Claude, ChatGPT, GitHub Copilot) execute a high volume of diverse discovery commands. The rule correlates multiple discovery categories, such as account, network service, system information, and network configuration discovery, occurring within a short timeframe to identify potential abuse of AI-integrated development tools for host reconnaissance.
Detects anomalous activity where AI assistant processes (e.g., Claude, ChatGPT, GitHub Copilot) execute a high volume of diverse discovery commands. The rule correlates multiple discovery categories, such as account, network service, system information, and network configuration discovery, occurring within a short timeframe to identify potential abuse of AI-integrated development tools for host reconnaissance.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects potential supply chain or local configuration tampering involving the Model Context Protocol (MCP). The rule identifies modification of common MCP configuration files, followed by the execution of a tool runner (node, python, npx) that spawns a scripting shell, which subsequently initiates an unusual outbound network connection.
Detects potential supply chain or local configuration tampering involving the Model Context Protocol (MCP). The rule identifies modification of common MCP configuration files, followed by the execution of a tool runner (node, python, npx) that spawns a scripting shell, which subsequently initiates an unusual outbound network connection.
Detects potential supply chain or local configuration tampering involving the Model Context Protocol (MCP). The rule identifies modification of common MCP configuration files, followed by the execution of a tool runner (node, python, npx) that spawns a scripting shell, which subsequently initiates an unusual outbound network connection.
Detects anomalous discovery behavior originating from known AI agent and development tools (e.g., Claude, Cursor, Aider). The rule monitors for a rapid sequence of commands spanning multiple categories of enumeration (Network, File/Directory, Software, and System) within a short timeframe, which indicates an attempt to map the runtime environment, permissions, or system capabilities.
Detects anomalous discovery behavior originating from known AI agent and development tools (e.g., Claude, Cursor, Aider). The rule monitors for a rapid sequence of commands spanning multiple categories of enumeration (Network, File/Directory, Software, and System) within a short timeframe, which indicates an attempt to map the runtime environment, permissions, or system capabilities.
Detects anomalous discovery behavior originating from known AI agent and development tools (e.g., Claude, Cursor, Aider). The rule monitors for a rapid sequence of commands spanning multiple categories of enumeration (Network, File/Directory, Software, and System) within a short timeframe, which indicates an attempt to map the runtime environment, permissions, or system capabilities.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
Detects the execution of known malicious MSI files associated with the LegionLoader malware family by monitoring process creation events involving msiexec.exe. The rule matches on specific file hashes and filenames identified in technical analysis of LegionLoader variants.
Detects instances where msiexec.exe, the Windows Installer utility, spawns cmd.exe to execute a batch file named 'xupdate.bat' located within the 'AppData\Roaming\Traiolx Custom Utils\' directory. This behavior is indicative of malicious persistence or execution mechanisms, often associated with loaders like LegionLoader that leverage installer binaries for evasion.
Detects the execution of a specific VBScript file 'Telegram_Private_Call_Session.vbs' via WScript, or its execution when spawned as a child process of MSHTA. This behavior is indicative of an HTA-dropped malicious script attempting to execute.
Detects the suspicious initiation of Control Panel applet functionality via the COM object 'COpenControlPanel'. Adversaries may leverage this COM interface or the associated 'CPL_INIT' message to proxy malicious code execution through standard Windows processes like dllhost.exe or rundll32.exe, effectively bypassing security controls that might otherwise flag the direct execution of malicious .cpl files.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
This rule monitors for execution of suspicious files or processes and network communication associated with known malicious indicators (hashes, domains, and IP addresses) typically used by specific threat actors for command and control (C2) and payload delivery.
Detects instances where the WindowsPackageManagerServer.exe (WinGet COM Server) is invoked to perform DSC (Desired State Configuration) operations (via ConfigurationStaticFunctions) by a process other than the standard winget.exe. This behavior is indicative of an attempt to bypass process-based monitoring of winget.exe by interacting directly with the COM API using custom or alternative tools like DSCourier.exe.
Detects the creation of a local user account and its subsequent addition to the local Administrators group via PowerShell cmdlets (New-LocalUser, Add-LocalGroupMember) triggered by the ConfigurationRemotingServer.exe process. This activity is indicative of abuse of the WinGet Desired State Configuration (DSC) 'Script' resource to establish persistent administrative access.
Detects the execution of the Python interpreter (pythonw.exe) renamed to 'codeflush.exe' residing in non-standard paths like '\Public\Music\MusicLibrariesPackage\'. This behavior is characteristic of adversaries attempting to camouflage malicious Python scripts or binaries as legitimate files to evade detection.
Detects execution of cmd.exe with suspicious command-line patterns utilizing environment variable substring expansion (%VAR:~offset,length%). This technique is used to dynamically reconstruct and execute obfuscated commands, a method historically observed in APT37 delivery chains to hide malicious payloads and bypass simple string-based signatures.
Page 95 of 976