Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects potential AI-obfuscated phishing attempts by correlating the launch of a local HTML file (likely from an email attachment or download) with immediate network connections to highly randomized or AI-generated subdomains. These subdomains are often used to host Adversary-in-The-Middle (AiTM) proxies or credential POST endpoints in sophisticated phishing campaigns.
Detects process executions originating from the XenoUpdateManager task that immediately initiate outbound network connections. This behavior is associated with Operation XENOFISCAL, where the SideCopy threat group deploys XenoRAT.
Correlates the execution of the initial dropper script (setup.cjs) to the hardcoded C2 IPs, indicating potential compromise by the Mastra NPM malware.
Detects MYRA Linux RAT establishing cron-based persistence by scheduling /usr/local/lib/.cache-update.sh to execute every 13 minutes with a fileless fallback chain using memfd_loader and agent_launcher. Indicative of the apintergrationpost npm supply chain attack by threat actor kimijohn01.
Detects attempts by unsigned or non-Microsoft processes to perform cross-process memory injection (such as CreateRemoteThread or NtCreateThreadEx) into critical processes including browser processes (chrome.exe, msedge.exe) or the local security authority subsystem service (lsass.exe).
Detects the use of 'sshpass' to supply a password to SSH while simultaneously disabling strict host key checking. This combination is often indicative of automated lateral movement or credential stuffing attempts where an attacker is trying to bypass host key verification to connect to multiple systems without manual intervention.
Detects network share enumeration commands executed inside a remote desktop session, matching post-access discovery of mapped corporate storage. This rule specifically looks for commands like 'net use', 'net view', PowerShell cmdlets such as 'Get-SmbShare', 'Get-PSDrive', 'Get-SmbMapping', WMI queries for 'Win32_LogicalDisk', or UNC path references ('\\') executed via 'cmd.exe', 'powershell.exe', 'pwsh.exe', 'net.exe', or 'net1.exe' within a remote session.
Detects SystemSettings.exe executing from any directory other than its legitimate location (C:\Windows\ImmersiveControlPanel\). This behavior is indicative of DLL side-loading, often used by malware like SharkLoader to execute malicious SystemSettings.dll.
Detects the 'strings' command being run directly against /proc/*/mem to extract human-readable strings (such as tokens or passwords) from raw memory. This activity is often associated with credential dumping techniques on Linux systems.
This rule detects potential exploitation attempts related to the 'Squidbleed' vulnerability (CVE-2021-28116) by monitoring 'squid.exe' process command lines for keywords indicative of stack variable overflow exploitation in its FTP parser. Specifically, it looks for the presence of terms like 'stack', 'heap', 'offset', 'buffer', or 'pointer' combined with 'overread', 'overflow', or 'bounds'.
Detects potential memory leak debugging or exploitation attempts related to the Squid proxy server by monitoring process command lines for keywords like 'leak', 'memory', 'valgrind', 'gdb', or 'debug'. This could indicate an adversary attempting to exploit a memory leak vulnerability or a developer debugging one.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, potentially by manipulating process arguments or environment variables to execute code as SYSTEM.
Detects the execution of 'squid.exe' with command-line arguments that contain whitespace characters potentially indicative of a NULL terminator vulnerability (Squidbleed). The rule specifically looks for common whitespace representations like 'w_space', 'space', 'tab', 'newline', '\n', '\r', and '\t' in the command line.
This rule detects when the 'squid.exe' process is executed with command-line arguments indicating a configuration reload, restart, or explicit use of 'squid.conf'. This could be indicative of an attacker manipulating Squid proxy settings, potentially as part of the Squidbleed vulnerability exploitation or other malicious activity.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, especially when combined with a successful logon event for the same user.
Detects the generation of core dump files by the Squid proxy server process, which could indicate a crash, segmentation fault, or an attempt to exploit a vulnerability like Squidbleed. This rule specifically looks for 'squid.exe' processes with command line arguments related to core dumps or crashes.
This rule detects the launch of a process where its command line contains references to 'RawWNPF' or '\device\rawwnpf'. This pattern is often associated with malicious activity, specifically related to the 'Fishmonger's Arsenal' campaign and the 'SprySocks' malware, which utilize RawWNPF for inter-process communication or other low-level operations. The rule focuses on capturing the principal and target context for further correlation and investigation.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
This rule detects potential exploitation attempts related to the Squidbleed vulnerability, specifically looking for command-line arguments indicative of heap buffer overread conditions within the 'squid.exe' process. It monitors for keywords such as 'strchr', 'buffer', 'overread', 'parse', 'directory', and 'listing' in the command line.
Detects suspicious command-line arguments associated with the 'squid.exe' process that may indicate exploitation attempts related to the Squidbleed vulnerability, specifically looking for patterns indicative of 4KB buffer freelist recycling. This includes keywords like 'malloc', 'free', '4096', '4KB', 'buffer', and 'MEM_'.
Detects the execution of the Squid proxy process with command-line arguments indicating the use of FTP parsing components. This could be indicative of a vulnerability exploitation attempt or unusual configuration.
Page 57 of 84