Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects attempts by users to disable or clear command line history logs for shell environments, including PowerShell (e.g., modifying PSReadLine history) and Unix-like shells (e.g., unset HISTFILE, setting HISTSIZE to 0, or disabling history collection). Such actions are frequently performed by adversaries to hinder incident response and forensic analysis by obscuring their post-exploitation activity.
This rule detects potentially malicious activity associated with removable media (USB drives) by identifying two distinct patterns: first, the creation of an 'autorun.inf' file on a removable drive followed by the execution of a script or executable from that same drive shortly after. Second, it identifies executables appearing on removable media that are launched across multiple distinct hosts within a one-hour window, which may indicate worm-like spreading or mass-malware distribution via portable storage.
Detects the execution of command interpreters (PowerShell, CMD, WindowsTerminal) spawned by common user-facing applications (Explorer, WindowsTerminal, DLLHost) where the command line arguments contain keywords associated with automated human verification (e.g., CAPTCHA, bot detection) and suspicious download/execution patterns (e.g., iex, base64). This behavior is characteristic of malicious automated scripts or malware attempting to bypass security challenges via interactive shells.
Detects cmd.jar, a JAR-based command executor used by threat actors on compromised Cisco Secure FMC to run arbitrary shell commands via /bin/sh -c
The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe.
smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters.
An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe.
If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise.
smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters.
An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe.
If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise.
Detects the creation of a scheduled task using 'schtasks.exe' where the initiating process is a script interpreter such as 'mshta.exe' or 'powershell.exe'. This behavior is often associated with the execution of malicious payloads or the establishment of persistence.
This rule detects potentially malicious activity associated with removable media (USB drives) by identifying two distinct patterns: first, the creation of an 'autorun.inf' file on a removable drive followed by the execution of a script or executable from that same drive shortly after. Second, it identifies executables appearing on removable media that are launched across multiple distinct hosts within a one-hour window, which may indicate worm-like spreading or mass-malware distribution via portable storage.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
This rule detects activities related to Tampermonkey (a popular browser extension for userscripts) or interactions with paste.sh, often used for hosting scripts or payloads. The rule monitors both process-level executions and network requests for these indicators, which may be associated with malicious script execution or browser-based credential or session theft.
The following analytic detects the use of download or file reading utilities from Windows, Linux or MacOS to download or read the contents of a file from a remote or local source and pipe it directly to a shell for execution.
This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions.
This activity is significant as it is commonly associated with malicious actions like coinminers and exploits such as CVE-2021-44228 in Log4j.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.
This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions.
This activity is significant as it is commonly associated with malicious actions like coinminers and exploits such as CVE-2021-44228 in Log4j.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects Run key persistence pointing to the known VBScript staging directory (C:\Users\Public\Libraries\Default\Lib\Lib1) used by the worm-like ScreenConnect campaign (Aug 2026), matching known script filenames (WindowsServiceHost.vbs, 1.vbs-4.vbs) invoked via wscript.exe/cscript.exe.
Matches known malicious dlp.sh/dlp-docker.sh Terraform module scripts used in Coder registry supply chain attack (common, aider, rstudio-server, windows-rdp, zed variants)
This rule detects the execution of specific DLP-related shell scripts (dlp.sh, dlp-docker.sh) being invoked by Terraform processes. This pattern may indicate suspicious automated infrastructure configuration or an attempt to bypass security controls by leveraging IaC tools to execute scripts.
This rule detects the execution of specific DLP-related shell scripts (dlp.sh, dlp-docker.sh) being invoked by Terraform processes. This pattern may indicate suspicious automated infrastructure configuration or an attempt to bypass security controls by leveraging IaC tools to execute scripts.
This rule detects potential automated web scraping activity by identifying high-volume, repetitive network requests directed towards domains identified as government (.gov) or military (.mil). It correlates these network patterns with the execution of common browser automation frameworks (e.g., Puppeteer, Playwright) or headless browsers, indicating a likely coordinated scraping operation or bot activity.
Detects suspicious execution of PowerShell or Mshta spawned from Explorer.exe. It looks for specific malicious indicators including references to known malicious domains, PowerShell encoding flags, hidden window arguments, or Mshta HTTP requests, which are common patterns for fileless malware or dropper execution.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Page 52 of 191