Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
This rule detects the execution of 'pythonw.exe' from the AppData\Local folder, which then initiates network connections to known Vidar C2 domains (brokeapt.com, pan.ssffaa19.xyz, pan.rongtv.xyz). This behavior is indicative of the Vidar stealer malware, often distributed via social engineering campaigns leveraging AI brands as bait.
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
This rule detects instances where 'node.exe' is executed from a temporary directory (e.g., 'temp' or 'tmp') and initiates a network connection to an IP address within the '23.254.164.0/24' subnet. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious node packages drop and execute payloads from temporary locations to establish C2 communication.
Detects the collection of system UUIDs or Machine IDs by non-standard processes. This activity is often associated with malware like Miasma, which uses this data to uniquely fingerprint compromised hosts for its botnet registry.
Detects changes to file permissions (chmod +x) for files located within the /tmp directory. This activity is often observed with malware droppers, such as Miasma, which use this technique to make downloaded payloads executable before launching them.
This rule detects processes that repeatedly attempt to allocate memory, which can be indicative of malicious activity such as injection, evasion, or resource exhaustion attacks. It specifically looks for Event ID 4688 (process creation) where the command line contains keywords related to memory allocation (allocate, reserve, memory, malloc) and excludes common legitimate processes like SQL Server, Java, and Python. A count of 3 or more such events within an hour for the same computer, filename, and user triggers the alert.
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Detects creation of setuid binaries used for Linux privilege escalation
This rule detects process command lines that indicate an attempt to execute a one-line install command from a GitHub raw content URL, often associated with untrusted or malicious projects. It specifically looks for common command-line tools used for downloading and executing scripts (like iex, Invoke-WebRequest, curl, wget, msiexec, Start-Process) in conjunction with keywords suggesting fake software or plugins (e.g., ChatGPT, Claude, AutoTune, Kontakt, plugin, installer).
Detects processes ignoring termination signals to prevent shutdown
Detects malware checking environment variables before executing payload
Detects removal of Zone.Identifier ADS to bypass MOTW security prompts
This rule flags a notarised macOS Flutter application whose web view can trigger command execution. Apple notarisation does not guarantee good intent. Investigate any unfamiliar app with this pattern. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
This rule detects two types of suspicious process activity. The first part identifies common Windows processes (svchost.exe, explorer.exe, system.exe, services.exe) executing with command lines that suggest driver loading or manipulation (e.g., containing 'driver', '.sys', 'load', 'unsigned', 'disabled UAC'). It flags instances where such activity occurs frequently (5 or more times) within a short timeframe (2 hours) and involves at least one unique driver file. The second part of the rule detects suspicious process termination attempts where specific legitimate Windows processes (MpCmdRun.exe, MsSense.exe, PsExec.exe, rundll32.exe) are observed attempting to terminate critical system processes (svchost.exe, lsass.exe, csrss.exe) multiple times.
This rule detects potential exploit attempts targeting Microsoft Word or Outlook by monitoring process crashes (AccessViolation) initiated by these applications, specifically when the command line indicates the processing of document or email file types (.docx, .eml, .rtf). This could indicate an attempt to exploit a vulnerability in these applications through a specially crafted file.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
This rule flags many npm republications from an account soon after suspicious token activity. Stolen maintainer tokens cause rapid malicious releases. Lock the account and audit download stats. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects exfiltration of running application window list for reconnaissance
Detects the execution of the 'whoami' command when its base64 encoded string ('d2hvYW1p') appears in a process command line. This pattern is often associated with web shells or other malicious activity attempting to gain system information.
Page 66 of 84