Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Parses PowerShell command lines to identify scripts extracting PGP private key blocks from arbitrary files to decode nested stagers.
This rule detects suspicious process execution patterns associated with malicious activities in GitHub Actions environments, specifically flagging the use of JavaScript runtimes (node, bun) to execute malicious payloads, git operations related to pull request data exfiltration (pwn-request), and the creation of orphan branches characteristic of the Miasma campaign.
This rule detects potentially malicious process chains: first, where common Windows utilities like explorer.exe, mshta.exe, or cmd.exe spawn PowerShell with suspicious arguments (hidden windows, execution policy bypass, or encoded commands). Second, it detects when Node.js is executed from user-writable directories (Temp, AppData, Downloads, ProgramData) by PowerShell or explorer.exe, excluding legitimate nodejs installation paths. These patterns are often associated with dropper behavior or initial access stages.
Detects the execution of Node.js build processes (node-gyp) or npm build commands involving native module compilation. These patterns are often indicative of legitimate development workflows but are also leveraged by attackers to compile malicious native add-ons or execute arbitrary code in a build environment.
This rule detects a behavioral transition where an active browser session (Chrome or Edge) navigates to a URL containing deceptive captcha/verify/human keywords, immediately followed by the invocation of PowerShell within a 3-minute window, initiated by explorer.exe. This pattern is indicative of the ClickFix attack, where a user is tricked into interacting with a malicious website that then triggers a PowerShell execution.
This rule detects the execution of Node.js or Bun JavaScript runtime processes with command-line arguments often associated with CI/CD automation, dependency updates, or potential obfuscated script execution patterns.
Detects the execution of the legitimate AutoIt3.exe interpreter launching a script (either .au3 or .a3x) that also initiates network connections to non-localhost IP addresses. This behavior is indicative of malicious activity, such as that observed with the Vidar stealer.
Detects macOS Terminal (bash/zsh) retrieving 'loader.sh' or 'payload.applescript' directly from the ClickFix attacker infrastructure, indicating potential compromise related to the ClickFix campaign.
Correlates the runtime replacement of junk encoding markers (DGtre) with standard Base64 characters within the payload, often seen in Vidar malware's obfuscation techniques.
Detects vLLM executing inline Python commands using the '-c' flag, a common post-exploitation technique. This rule specifically looks for process command lines containing 'vllm' and a Python interpreter (python or python3) executing code via the '-c' flag, which is indicative of inline command execution.
Detects PowerShell establishing a reverse shell using the .NET Net.Sockets.TCPClient class and GetStream method. This is a common technique used by adversaries to create an interactive shell for remote control.
Detects taskkill, PowerShell, Windows Management Instrumentation or command-shell activity that attempts to terminate Discord. This activity is often seen with stealers like VVS Stealer which stops active Discord processes before replacing application support files with injected JavaScript.
This rule detects a specific command-line pattern executed via `cmd.exe` that is associated with the ClickFix attack. The pattern involves moving an `update.zip` file from the user's downloads directory, extracting a `u.zip` file in the temporary directory using `tar`, and then executing an `update.bat` script. This sequence of actions is indicative of a multi-stage malicious payload deployment.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
This rule detects potential persistence and execution of suspicious VBScript files ('Telegram_Private_Call_Session.vbs' or 'assurance.vbs'). It monitors for the creation or modification of these files within the Windows Startup folder, their execution via wscript.exe, and the creation of corresponding registry entries to ensure automatic startup.
This rule detects PowerShell or CMD processes executing host profiling and system discovery commands (e.g., whoami, hostname, systeminfo) that are initiated by processes linked to the 'lightlife.ps1' script or associated Lightlife RAT activity.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Detects the execution of a suspicious 'setup.cjs' script via Node.js triggered during an 'npm install' process, characteristic of the malicious payload delivery mechanism found in compromised Mastra packages. The rule specifically monitors for Node.js spawning a process with command-line arguments including 'setup.cjs' and the '--no-warnings' flag.
Detects instances where a process associated with the 'brand-landingpage' AI agent or processes involving scripts from 'stitch-design.ai' spawn child processes, potentially indicating malicious activity leveraging the agent's runtime permissions.
Detects the execution of a Python-based collection module associated with the Gaslight malware on macOS. The module performs reconnaissance by enumerating system information using 'system_profiler' and running processes via 'ps aux', followed by the collection of sensitive data including browser files and the login keychain.
Detects malicious multi-stage download behavior where a web browser spawns PowerShell to initiate an outbound network connection, characteristic of the 'ErrTraffic' Beer cluster often associated with ClickFix infection lures delivering malware such as DanaBot, Stealc, HijackLoader, SmokeLoader, or Vidar.
Page 119 of 191