Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects the execution of a PowerShell script named 'sp.ps1' which has been associated with the Seedworm (also known as Sandworm Team) threat group for gathering screenshots. This rule specifically looks for 'sp.ps1' within process command lines.
Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.
Identifies the fake VPN installer using WMI to query SecurityCenter2 to identify installed security products before unpacking the stealer. This rule specifically looks for 'wmiprvse.exe' executing with command-line arguments related to 'AntiVirusProduct' and correlates this with the execution of processes named 'GlobalProtect', 'AnyConnect', or 'VPN'.
Identifies Node.js initiating exfiltration connections to the C2 with parameters indicating disabled TLS certificate validation.
Detects the modification of Windows Registry run keys by node.exe. This activity is often used by adversaries to establish persistence, where a malicious Node.js script or application is set to automatically execute upon user logon.
Detects the execution of specific binaries (vmtools.exe, vmwared.exe, XDRAgent.exe) from the C:\ProgramData\VMware directory. This path is often used by adversaries to masquerade malicious files or execute tools from a directory that might be excluded from security scanning.
Identifies the ransomware executing taskkill or native APIs to force-quit database and backup processes (SQL, Exchange) to free file locks. This rule specifically looks for 'taskkill.exe' being executed multiple times (more than 3 within a minute) with command-line arguments targeting common database or backup-related process names like 'sql', 'exchange', 'veeam', 'backup', or 'oracle'.
Detects the creation or opening of a named event (SyncedEventCreate, SyncedEventOpen, CreateEvent, OpenEvent) on Windows systems using the specific, potentially malicious, object name 'ShitSetupOn26126k'. This pattern often indicates inter-process communication associated with specific malware or unauthorized tool execution.
Detects the use of bitsadmin.exe or certutil.exe to download and install legitimate Remote Monitoring and Management (RMM) tools like ConnectWise Control. This activity is often associated with adversaries establishing persistent graphical access after initial compromise, as observed in campaigns like Storm-1175.
Identifies Storm-1175 abusing legitimate enterprise software deployment tools like PDQ Deploy to push the Medusa encryptor to all domain endpoints simultaneously. The rule correlates process events related to PDQ Deploy with file events indicating the creation of files with a '.medusa' extension, which is characteristic of the Medusa ransomware.
Detects specific suspicious executables that load the Antimalware Scan Interface (AMSI) library (amsi.dll). This pattern is often indicative of attempts to disable or bypass AMSI scanning, commonly seen in malicious loaders or tools aimed at evading security monitoring.
Identifies when the AutoIt3.exe process accesses cryptocurrency wallet files or directories such as MetaMask, Exodus, Coinomi, or wallet.dat. This behavior is indicative of information stealer malware like Vidar attempting to exfiltrate sensitive cryptocurrency data.
Detects cross-process activity originating from the 'nvdaHelperRemote.dll' library targeting 'svchost.exe'. This pattern is indicative of potential process injection where a malicious actor or suspicious process attempts to inject code or manipulate the memory space of a core Windows system process via this specific helper library.
Identifies the use of the macOS ditto utility to compress stolen datasets into a single archive, specifically preserving resources, as observed in AMOS malware activity.
Detects the script escalating privileges using the stolen password via sudo to strip quarantine extended attributes from the payload.
Detects malicious command injection where GitHub Actions interpolates ${{ github.event.comment.body }} directly into a bash run block, specifically looking for patterns associated with the 'curl.litter.catbox.moe..sh' domain.
Identifies the AppleScript stealer validating the phished user password locally using the dscl . -authonly command.
Detects curl POST requests sending JSON telemetry to attacker endpoints post-infection, specifically looking for patterns associated with the ClickFix campaign.
Correlates the stealer invoking system_profiler via osascript to search for virtualization strings to halt execution in sandboxes.
Identifies the execution of files with classic double extensions designed to trick users into clicking what they think is a document. This rule specifically looks for filenames ending with common document/image extensions followed by executable extensions.
Detects vLLM executing inline Python commands using the '-c' flag, a common post-exploitation technique. This rule specifically looks for process command lines containing 'vllm' and a Python interpreter (python or python3) executing code via the '-c' flag, which is indicative of inline command execution.
Page 55 of 84