Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,453
11,838
5,876
5,154
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of Python scripts named 'exploit.py' or 'exp.py', which are common naming conventions associated with proof-of-concept or exploit code.
This rule detects potentially malicious command execution patterns in Linux environments. It monitors for shell commands (bash, sh, echo, tee, cat) involving base64 decoding redirected to shell configuration files (e.g., .profile) or specific patterns involving 'gs-dbus' processes, which are often used by threat actors to decode obfuscated payloads or maintain persistence.
Detects execution patterns associated with the ClickFix attack vector on macOS, where Terminal.app spawns a piped curl-to-shell command, typically used as an initial entry point for malware such as the AMOS (Atomic macOS) stealer.
Detects the deployment and activity of SilkParasite-associated Linux threats, including XMRig cryptocurrency miner shell scripts and standalone Meterpreter agents. The rule also captures the execution of a custom Python fleet-scanning tool used to interact with exposed Redis instances for unauthorized command execution and infrastructure management.
This rule detects command-line activity where a remote resource is downloaded via 'curl', decoded using 'base64', and then piped directly into a shell interpreter (sh, bash, or zsh). This pattern is commonly used in fileless execution or stage-one payload delivery by attackers to execute malicious scripts directly from memory.
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects the creation of a scheduled task using schtasks.exe where the command line involves 'MicrosoftNodeRuntimeUpdater' and references 'node.exe' or '.js' files, specifically when initiated by script engines like node.exe, wscript.exe, or cscript.exe, while excluding known legitimate nodejs installation paths.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
Detects the execution of PowerShell encoded commands that result in the installation of known remote monitoring and management (RMM) software. This pattern is indicative of attackers, specifically those associated with Ransom Busters or similar affiliates, establishing persistent remote access to compromised systems.
Detects suspicious command-line entries within the Windows RunMRU registry key, which logs recently executed commands from the Run dialog (Win+R). This detection targets common ClickFix or copy-paste attack patterns, specifically identifying the presence of 'powershell', 'curl', or long base64-encoded strings.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects the creation of a scheduled task named 'OneDriveUpdateScheduler' or the execution of a related VBScript, which are commonly used by adversaries for persistence and code execution. This rule monitors process creation events for indicators of malicious task scheduling or script execution mimicking legitimate update processes.
This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.
Detects instances where a Langflow process spawns a Python process using command-line arguments involving base64 decoding or character-based execution, which is often indicative of malicious code injection or shellcode execution.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
This rule detects potential persistence mechanisms where a suspicious batch file (.bat) is placed within the Windows Startup folder and subsequently executed using command-line arguments that include specific file extensions like .exe and .ini. This behavior is indicative of malware, such as remote access trojans (RATs), attempting to maintain persistence upon system reboot.
Detects Python scripts containing natural-language comments that narrate attack rationale, reasoning, or step-by-step intent. This behavior is a diagnostic signature of scripts generated or operated by AI agents, which tend to document their own processes in plain text comments, unlike human-written malicious code.
Page 42 of 191