Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects suspicious execution of 'osascript' by processes that are not typically user-interactive, often indicative of C2 command dispatch or malicious AppleScript execution. The rule specifically looks for 'osascript' being spawned by processes other than common user applications (Finder, Terminal, iTerm2, etc.) or Apple-related processes, and checks for command-line arguments associated with executing shell commands via AppleScript or direct shell command execution patterns.
Detects instances where 'osascript' is used to execute commands that include suspicious keywords often associated with obfuscated or malicious scripts. This can indicate an attempt to run arbitrary code, potentially for initial access, execution, or persistence on macOS systems.
Detects the execution of curl commands that involve base64 decoding, often used by adversaries to download and execute obfuscated scripts or payloads. The rule specifically looks for common shell utilities (curl, zsh, bash, sh) executing commands containing 'base64 --decode' and 'curl', along with specific suspicious domains or a generic base64 encoded string pattern.
Detects PowerShell invoking Add-Type to compile C# code inline, indicative of PS1Bot malware. Specifically looks for the use of 'Add-Type' in PowerShell command lines combined with specific C# methods like 'SetWindowsHookEx', 'Graphics', or 'CopyFromScreen', which are often used for screen capture or other malicious activities.
Detects the execution of Python-based OpenClaw modules running directly out of newly cloned or extracted GitHub repository structures, specifically looking for Python processes where the command line includes patterns indicative of a cloned or extracted repository (e.g., '-main' or '-master' followed by a Python script).
Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.
This rule detects the execution of JavaScript files named 'bw_setup.js' or 'execution.js' using the 'bun' runtime, immediately followed by an outbound network connection to the command and control (C2) domain 't.m-kosche.com'. The detection logic correlates process execution events with network connection events within a 10-minute window, indicating potential malicious activity associated with supply chain attacks.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects execution of PowerShell with encoded commands, often used in malicious scripts.
Detects the WMI provider executing heavily encoded commands mapped to Kazuar's tasking structure for lateral movement. Specifically, it looks for 'wmiprvse.exe' initiating processes that execute PowerShell or cmd commands containing encoding indicators like 'enc' or 'FromBase64String'.
Detects the execution of processes with command lines containing keywords associated with FormBook RAT, initiated by common scripting interpreters like PowerShell, cmd, or wscript. This rule aims to identify potential FormBook RAT loader activity.
Detects the execution of PowerShell with the '-WindowStyle Hidden' flag, specifically when initiated by 'explorer.exe', which is a known tactic used by the ClickFix malware to mask its payload execution.
Detects the polymorphic script's initial action: patching the AmsiScanBuffer to prevent Defender from catching the subsequent payload. This rule specifically looks for PowerShell commands containing 'amsiInitFailed' or 'AmsiScanBuffer', which are indicators of attempts to bypass AMSI.
Detects PowerShell utilizing [Runtime.InteropServices.Marshal]::WriteInt32 to overwrite the amsiContext memory space with 0x41414141, indicating an attempt to bypass AMSI.
Hunts for the reflective .NET loader dynamically invoking methods while spawning RegAsm.exe as the execution proxy. This rule detects when 'RegAsm.exe' is spawned by 'powershell.exe' and is associated with an 'AllocateVirtualMemoryApiCall' event, indicating potential reflective code loading and execution.
Detects AutoHotkey (AHK) scripts executing from the 'Microsoft.WindowsSoundDiagnostics' directory, which is an unusual location for such scripts and has been observed as a staging directory for malware like AsyncRAT. This rule specifically looks for process events where the initiating process or the process itself is located in 'Microsoft.WindowsSoundDiagnostics' and the command line contains '.ahk'.
Identifies Python-based automated Graph API queries searching the directory based on name patterns and role attributes. This rule correlates sign-in logs with Microsoft Graph CloudAppEvents to detect suspicious activity originating from Python scripts interacting with the Microsoft Graph API.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory, often associated with the XWorm malware.
Detects PowerShell commands that contain a reversed string pattern often used by Vidar malware to de-obfuscate its C2 endpoint at runtime. The specific pattern 'txt.[0-9a-zA-Z]+/selif_cilbup' is indicative of this technique.
Detects copying executables, scripts, or archives to a remote C$ share immediately before remote execution. This behavior is associated with the 'Gentlemen Ransomware' as described in the referenced Microsoft blog.
Page 124 of 191