Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Detects the execution of forced system shutdown commands (shutdown -s -t 0) initiated via cmd.exe or PowerShell. This behavior is often observed in post-compromise scenarios, including the TonRAT campaign, to disrupt system availability.
Detects the execution of a PowerShell script named 'cap.ps1' using common obfuscation and evasion flags including '-windowstyle hidden' and '-executionpolicy bypass'. This pattern is frequently used by adversaries to execute malicious scripts while minimizing user visibility and bypassing standard security policy restrictions.
Detects the execution of VBScript files (via wscript.exe or cscript.exe) where the parent process is a common web browser (Chrome, Firefox, Edge, or IE). This pattern is frequently indicative of a drive-by download or social engineering attack where a user is tricked into executing a malicious script originating from a web-based context.
Detects the creation of the 'MixedSvc' Windows service, which is used by DcRAT malware in Operation DragonReturn for persistence. The malware masquerades as 'Windows Mixed Reality Service' and sets the service's binPath to 'C:\Program Files\Windows Media Player\Mixed Reality.exe'.
This rule detects a sequence of events indicative of ransomware deployment following a successful Remote Desktop Protocol (RDP) connection. Specifically, it looks for an inbound RDP connection (RemotePort 3389) to a device, followed within 60 minutes by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') on the same device. This pattern suggests an attacker gaining initial access or moving laterally via RDP and then deploying ransomware.
Detects potential DCOM lateral movement where 'mmc.exe', 'wmiprvse.exe', 'excel.exe', or 'dllhost.exe' are spawned with the '-Embedding' flag by 'svchost.exe' under the 'DcomLaunch' or 'RPCSS' services. This indicates that RPCSS performed a HKCR\CLSID registry lookup and activated a COM server object on the host, which can be abused for remote code execution.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
This rule detects the creation or configuration of a scheduled task named 'GoogleErrorReport' which references 'Fondue.exe' located in the 'C:\Users\Public' directory. This specific pattern is associated with 'Dropping Elephant' malware persistence, where the task ensures the binary executes persistently on the host.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects file creation events related to known GLASSWORM VS Code extension files or WebAssembly (WASM) loader JavaScript shims. It also identifies process execution where the VS Code extension host spawns 'node.exe' with known GLASSWORM JavaScript shims. This rule aims to identify the presence and execution of the GLASSWORM malware.
Detects the mounting of an ISO file, particularly those with diplomatic lure filenames, followed by the execution of an executable from a newly mounted optical or removable drive. This sequence of events is indicative of an attacker using a malicious ISO to deliver and execute malware.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
Detects the SHEETCREEP malware's melt function, which uses a hidden 'cmd.exe' process to forcibly delete executables. This is characterized by 'cmd.exe' spawning with a specific command line pattern involving 'choice /C Y /N /D Y /T 2' for a delay, followed by 'del /f /q' to delete an .exe file. The rule also looks for file deletion events of .exe files initiated by 'cmd.exe' outside of the C:\Windows\ directory with 'del /f' or 'del /f /q' in the command line.
This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.
Detects instances where OpenVPN Connect executables (OpenVPNConnect.exe, openvpn.exe) spawn shell interpreters or script hosts. This pattern is often indicative of exploitation or post-exploitation activities, as legitimate VPN client operation does not typically require the execution of cmd.exe, PowerShell, or script engines.
Detects instances where the Ghidra reverse engineering tool (via java.exe or javaw.exe) spawns suspicious child processes. This behavior is considered anomalous as Ghidra typically does not require launching command shells, scripting interpreters, or other system binaries directly from its process tree. Such activity often indicates that an attacker is using the Ghidra environment to execute secondary payloads or perform post-exploitation tasks.
Detects the execution of suspicious binaries spawned by the Windows script hosts (wscript.exe, cscript.exe) from the AppData directory. This pattern is indicative of the Grandoreiro banking trojan, which masquerades as an Adobe Reader update prompt and drops its payload into temporary folders to execute.
Detects potential exploitation attempts against Flowise by monitoring for suspicious child process creation. The rule flags Node.js processes spawned by Flowise that utilize case-insensitive command-line bypass patterns or reference suspicious environment variables, which may indicate an attempt to override security configurations through environment variable manipulation (e.g., node_options).
Detects the use of 7za to extract archives into the Avast Software directory, a behavior observed in Pay2Key ransomware campaigns to perform DLL hijacking for execution, persistence, or privilege escalation.
Detects the execution or creation of files named GT_NET.exe or Gt_net.exe, which are associated with the Grixba ransomware (Play Ransomware group). The rule also identifies files that masquerade as SentinelOne by utilizing SentinelOne-related product, company, or description metadata but are located outside of the legitimate SentinelOne installation directory.
Page 476 of 977