Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects instances where the Remote Desktop Client (mstsc.exe) is launched from common web browsers or email clients, followed shortly thereafter (within 120 seconds) by the execution of a potentially suspicious child process such as PowerShell, command prompt, WScript, or MSHTA. This pattern is indicative of a user-initiated execution flow that may be part of a phishing attack or malicious payload delivery.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Detects the execution of mshta.exe with a .hta file path located in common user-writable directories (Temp, Downloads, AppData, User Profile) accompanied by suspicious filename themes often associated with phishing or social engineering, such as military, salary, or diplomatic lures.
Detects instances where the Remote Desktop Client (mstsc.exe) is launched from common web browsers or email clients, followed shortly thereafter (within 120 seconds) by the execution of a potentially suspicious child process such as PowerShell, command prompt, WScript, or MSHTA. This pattern is indicative of a user-initiated execution flow that may be part of a phishing attack or malicious payload delivery.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript, PowerShell) to launch the Microsoft Build Engine (MSBuild) for potentially malicious code execution.
This rule detects the execution of a VBScript file named 'ResetRealtekAudioSettings64.vbs' by 'wscript.exe'. This specific activity has been associated with AsyncRAT, where it's used to continue the execution chain, potentially to spoof audio settings or for other malicious purposes.
Detects attempts to clear Windows Event Logs using either the wevtutil command-line utility, PowerShell Clear-EventLog cmdlets, or by monitoring specific Windows Security Event IDs 1102 and 104 which indicate logs have been cleared.
Detects attempts to disable the Windows Firewall using the netsh command-line utility or PowerShell cmdlets, as well as registry modifications related to firewall profiles. Adversaries often perform this action to impair host-based security controls and facilitate unauthorized inbound or outbound network traffic.
This rule detects instances where Microsoft Management Console (mmc.exe) spawns a hidden PowerShell process that attempts to execute commands using 'IEX' (Invoke-Expression) combined with 'DownloadString' or 'Net.WebClient'. This pattern is commonly associated with malicious activity, such as downloading and executing payloads from a remote source, often to evade detection.
This rule detects various activities associated with the Remcos Remote Access Trojan (RAT). It identifies the execution of JavaScript payloads (potentially MonoGlyphRAT) via script hosts (wscript.exe, cscript.exe), direct execution of 'remcos.exe', 'cmd.exe /c' spawned by 'remcos.exe' indicating C2 shell activity, and the creation of registry keys for Remcos persistence.
Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.
Detects potential fileless execution of Meow RAT by monitoring process command lines for 'curl' fetching an AppleScript payload and piping it to 'osascript'. It also looks for specific Meow RAT indicators like C2 domains, payload names, and build hashes.
Detects UNG002's tactic of hiding malicious VBScripts 4+ levels deep in folders mimicking macOS metadata (__MACOSX) to evade automated scanners.
Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.
This rule detects instances where 'msiexec.exe' spawns 'cmd.exe' to execute a batch or command file (.bat or .cmd) located within the 'AppData\Roaming' directory. This behavior can be indicative of malicious activity, as adversaries often use msiexec.exe for proxy execution and drop malicious scripts in user-writable directories like AppData.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects anomalous execution patterns involving Node.js and Bun runtimes, specifically identifying suspicious process lineage such as node processes spawned by node.gyp, or Bun execution patterns involving temporary files or specific command-line arguments. Additionally, it alerts on the execution of a specific known malicious file hash.
This rule detects potentially malicious process chains involving PowerShell and Node.js. It specifically flags cases where PowerShell launches PowerShell or Node.js with command lines containing suspicious file patterns (e.g., .lnk masquerading as images) or when Node.js is executed from PowerShell in user-writable directories (e.g., AppData, Temp) with command lines referencing known malicious domains.
Detects execution patterns associated with the Miasma/Mini Shai-Hulud multi-layer obfuscated npm payload. This includes monitoring for bun runtime spawning from Node/NPM contexts, execution of bun with specific patterns from /tmp, downloading of specific bun versions from GitHub, and execution of suspicious index.js scripts within .claude directories.
Page 101 of 191