Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects the creation of named pipes associated with known command-and-control (C2) frameworks, post-exploitation toolkits, and suspicious system activity. By filtering out common legitimate system processes and monitoring for specific pipe patterns (e.g., Cobalt Strike, Metasploit, PsExec, and sensitive RPC endpoints), the rule identifies potential lateral movement, remote execution, and post-exploitation communication channels.
Detects processes associated with Remcos RAT or processes with names matching a GST.*.com pattern that are attempting to capture user input by looking for specific API calls or keywords related to keylogging in the process command line. This could indicate an attempt to steal credentials or other sensitive information.
This rule detects potential exploitation attempts related to the Squidbleed vulnerability, specifically looking for command-line arguments indicative of heap buffer overread conditions within the 'squid.exe' process. It monitors for keywords such as 'strchr', 'buffer', 'overread', 'parse', 'directory', and 'listing' in the command line.
Detects attempts by unsigned or non-Microsoft processes to perform cross-process memory injection (such as CreateRemoteThread or NtCreateThreadEx) into critical processes including browser processes (chrome.exe, msedge.exe) or the local security authority subsystem service (lsass.exe).
Detects the deletion of staging artifacts using cmd.exe and the timeout command, a technique used by result.dll (GIFTEDCROOK) for self-deletion after exfiltration. This rule specifically looks for command-line patterns indicative of a delayed file deletion using `timeout /t 5` followed by `& del`.
Detects attempts by the Remcos RAT to access audio and video capture devices (camera, microphone) by monitoring process command lines for keywords related to these devices. It also looks for processes initiated by PowerShell or cmd.exe, which are common methods for malware execution.
This rule detects attempts to stop security services (like Windows Defender) or clear event logs using 'sc stop', 'net stop', or 'wevtutil cl' commands, specifically when initiated by 'explorer.exe'. This behavior, especially when originating from explorer.exe, can indicate an adversary attempting to impair defenses or remove forensic evidence.
Detects the ClickOnce shim DLL (dfshim.dll) being loaded by non-standard processes, indicating potential sideloading or execution abuse. The rule specifically excludes common legitimate processes like explorer.exe, rundll32.exe, dfsvc.exe, and presentationhost.exe from triggering an alert.
Detects the decoded execution of bash/sh reverse shells initiated from processes like node.exe or python.exe, which is indicative of the Void Dokkaebi threat actor's tactics. The rule specifically looks for command lines containing 'echo' with base64 encoded strings, followed by 'base64 -d' and then 'sh' or 'bash' for execution.
Identifies kubectl executed from the Python payload dumping secrets across all available cluster namespaces.
Detects behavior patterns associated with Payouts King ransomware, including direct syscall-style API calls (NtAllocateVirtualMemory, NtWriteVirtualMemory, CreateRemoteThread) from processes other than trusted system binaries, and the loading of ntdll.dll from non-standard file paths (outside System32/SysWOW64). It also includes a hash-based detection for known Payouts King malicious samples.
This rule detects suspicious memory manipulation and thread injection activities directed at 'svchost.exe' or 'explorer.exe' by processes other than standard system components. Such behavior is often indicative of malicious code injection, where an attacker attempts to run arbitrary code within the address space of trusted system processes to bypass security controls or achieve persistence.
Detects the 'BadBlocker' Adblock for YouTube browser extension communicating with its command-and-control infrastructure to fetch and execute arbitrary scriptlets in the MAIN JavaScript world. By injecting directly into the page context, the extension gains unauthorized access to the DOM, user browsing sessions, and sensitive form data.
Detects process command lines containing references to sensitive Unix system files (/etc/passwd or /etc/shadow) specifically when accessed within or in association with a /troot/ directory path. This pattern is often indicative of an adversary performing reconnaissance or credential dumping.
This rule detects instances where wscript.exe or cscript.exe initiate a WMI activity that specifically queries for 'Win32_Process' and contains 'taskmgr.exe' within the query. This combination can indicate an attempt to enumerate or interact with the Task Manager process via scripting, which might be indicative of malicious activity such as process hiding or manipulation.
This rule detects suspicious access to macOS Keychain files or the use of the 'security' utility to manipulate keychains. It specifically looks for 'osascript' accessing keychain-related paths, the 'security' utility using commands like 'unlock-keychain' or 'find-generic-password', or common shell utilities ('cp', 'cat', 'sh', 'bash', 'zsh') accessing keychain database files. This activity is often indicative of credential access attempts.
Detects the execution of a process named 'servertool.exe' specifically when it originates from a user's OneDrive Music folder or a generic Music folder within the user profile. This could indicate an attempt to masquerade malicious activity by placing an executable in an unusual, typically benign location.
Detects various suspicious activities related to macOS wallet applications, including the removal of Gatekeeper quarantine flags, ad-hoc re-signing of application bundles, force-killing wallet applications, non-installer processes writing to application bundles (specifically 'app.asar'), and the use of 'dscl . authonly' which can be abused for fake password prompts.
This rule detects the execution of multiple system and file discovery commands within a short timeframe, which can be indicative of an adversary performing reconnaissance. The rule specifically looks for common Windows commands like 'systeminfo', 'whoami', 'ipconfig', 'net', 'tasklist', 'net user', 'net localgroup', 'wmic os get', 'wmic product get name', 'dir /s', 'Get-ChildItem', and 'Get-Process' executed via cmd.exe, powershell.exe, or wmic.exe. It triggers if at least 3 commands are executed or if at least 2 distinct tools are used within an hour.
Detects process doppelganging using NTFS transactional operations
Detects behavior patterns associated with the SharkLoader malware, specifically monitoring for anomalous thread creation, potential modification of primary tokens, and suspicious loading of SystemSettings.dll from non-standard directories (e.g., AppData, ProgramData). This rule aims to identify evasive techniques used to bypass Windows Loader Lock detection.
Page 42 of 84