Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the presence or execution of artifacts associated with the TrustSink proof-of-concept (deploy.py, cleanup_eam.py, deploy_state.json), which is used to register or remove rogue Entra authentication providers.
Detects instances where the rnpkeys process (likely used for GPG-related operations) spawns common Windows living-off-the-land binaries such as rundll32, regsvr32, msiexec, cmd, powershell, or wscript. It specifically monitors for patterns indicating potential script execution from temporary folders, the bypass of PowerShell execution policies, or the installation of products via msiexec, which may indicate malicious activity following initial compromise or delivery of a malicious payload.
Detects multiple, rapid execution sequences of Python or PIP utilities using the 'install' flag with specific common library names often used in reconnaissance or malicious activity. This activity is monitored by looking for repetitive installations of targeted packages within a short timeframe on the same endpoint, which may indicate automated tool deployment or preparation for malicious operations.
TokenGrabber Builder: Nuitka/PyInstaller AV-Evasion Compilation - detects Python builder scripts compiling an embedded stealer.py payload into a native executable via Nuitka or PyInstaller with AV-evasion flags
Detects a suspicious sequence of events where a user or system initiates a PowerShell script (update1.ps1) via Windows Explorer in close temporal proximity (within 5 minutes) to the execution of known update-related tasks or scripts (OneDriveUpdateScheduler or update1.vbs). This correlation aims to identify potential persistence or malicious activity masquerading as update processes.
Detects PowerShell processes using .NET screen capture libraries (System.Windows.Forms/Drawing) to generate image files in common staging directories like Temp or Public folders, which is a common pattern for malicious screen capture exfiltration.
Detects a suspicious execution chain where explorer.exe (typically via the Run dialog) executes PowerShell, which subsequently launches msiexec.exe to silently install the PuTTY SSH client. This sequence is characteristic of the 'ClickFix' technique, which uses social engineering to trick users into running malicious commands for remote access deployment.
Detects the execution of PowerShell with the -NoProfile flag initiated by wscript.exe or cscript.exe, containing sleep/delay commands alongside network download functions. This pattern is characteristic of malware loaders or RMM phishing kits attempting to evade sandbox analysis before initiating a remote download.
Detects potential malicious activity where a process associated with a Claude agent (or a downloader utility) references a 'SKILL.md' configuration file. This behavior is indicative of a poisoned skill file being used to trigger unauthorized payload downloads or re-establish persistence.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
This rule detects potentially malicious process execution chains where VBScript or unknown/suspicious binaries (such as ProfileQuickHost.exe) are used to launch Node.js processes, specifically targeting JavaScript files or VBScript agents. This pattern is often associated with the execution of remote access trojans (RATs) or custom malware loaders.
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects potential abuse of Azure Cloud Shell backing storage (acsCloudShell) to stage or persist malicious scripts following an Azure AD session compromise. Adversaries may use this storage to blend in with legitimate engineering operations while maintaining persistent access to their tooling.
Detects a multi-stage loader execution chain, potentially named GHAPPIER, by identifying sequential stages of execution. These stages include initial marker file checks, shell-based command dispatching via curl/wget, renaming and execution of secondary payloads, Node.js-based runtime staging, and the eventual creation of implant artifacts in common paths such as VSCode extensions or hidden directories.
Detects instances where a Node.js process (node.exe) initiates command-line interpreters (cmd.exe, powershell.exe) with specific arguments or command lines associated with administrative or potentially obfuscated/automated script execution. This is a common pattern for post-exploitation activities or legitimate administrative automation.
This rule detects a sequential multi-stage execution chain starting with msiexec.exe launching a hidden PowerShell script, followed by wscript.exe executing a VBScript agent, and finally node.exe executing a JavaScript file within a short time window. This pattern is indicative of a complex, multi-stage dropper or malware execution flow.
Detects the presence of Node.js runtime files (node.exe, index.js) or script-based agents (vbs, ps1) located within user-profile paths (AppData) that mimic legitimate Windows system folders. This pattern is characteristic of masquerading techniques used to stage or run malicious agents under the guise of system components.
Detects the staging of ChainScript files into specific, masquerading subdirectories within user AppData folders that mimic legitimate Windows system paths. This activity is indicative of the _scatter.ps1 script redistributing components such as the Node.js runtime, agent configuration, and helper utilities before execution.
Detects suspicious command-line patterns typically used for downloading or executing malicious payloads, such as curl, base64 encoding, and PowerShell web requests, when spawned directly from Node.js or Visual Studio Code processes. This behavior is associated with supply chain compromises and loader activity (e.g., WaterPlum/Contagious Interview) targeting development environments.
Detects potential Command and Control (C2) activity leveraging the OpenAI Assistants API. The rule identifies non-standard processes (e.g., PowerShell, Python, cmd) that establish network connections to OpenAI API endpoints, specifically those often used for interaction with AI models, suggesting potential abuse of AI services for command issuance or data exfiltration.
This rule detects the creation, modification, or renaming of .lnk shortcut files within the Windows Startup folders (both current user and roaming appdata). It then correlates this activity with the execution of AutoIt3.exe or processes identified as 'AutoIt' that are running scripts with .a3x or .au3 extensions, which are commonly used for persistence and execution of malicious automation scripts.
Page 17 of 191