Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects the presence or execution of a 'preinstall' script located within a path structure typical of macOS installer packages containing an 'Extra' directory. Such scripts are often used during software installation to perform arbitrary tasks with elevated privileges and may be abused by adversaries for persistence or malicious payload delivery.
Detects the execution of bash or shell commands associated with a hidden directory '.task' and a specific script 'tokenlinux.sh'. This pattern is indicative of potential persistence mechanisms, unauthorized script execution, or command-and-control (C2) activity in a Linux environment.
This rule detects the presence or execution of a 'preinstall' script located within a path structure typical of macOS installer packages containing an 'Extra' directory. Such scripts are often used during software installation to perform arbitrary tasks with elevated privileges and may be abused by adversaries for persistence or malicious payload delivery.
Detects the execution of bash or shell commands associated with a hidden directory '.task' and a specific script 'tokenlinux.sh'. This pattern is indicative of potential persistence mechanisms, unauthorized script execution, or command-and-control (C2) activity in a Linux environment.
Detects the installation of RustDesk or Cloudflared as a persistent Windows service, initiated by a PowerShell script. This behavior is indicative of unauthorized use of remote access or tunneling tools, often observed in intrusion activity such as Bumblebee, AdaptixC2, or Akira ransomware to facilitate persistence and establish reverse tunnels through firewalls.
Detects the execution of VBS scripts (wscript.exe or cscript.exe) that interact with the Windows Startup folder to create shortcuts. This behavior is associated with persistence mechanisms where malicious scripts create masqueraded shortcuts (e.g., SecurityHealth, OneDriveUpdate) in the user's Startup folder, often using hidden attributes to evade detection.
This rule detects instances where a Python interpreter loads the 'snap7.dll' library or executes processes containing 'snap7' or 'python-snap7' in the command line. Snap7 is an open-source library used for communication with Siemens S7 PLCs. This detection helps identify potential unauthorized or suspicious interaction with Industrial Control Systems (ICS) via Python scripts.
Detects ClickFix-style social engineering attacks where users are lured into executing obfuscated commands via terminal copy-paste. The detection monitors for the sequential execution of remote file downloads (e.g., curl, PowerShell) followed immediately by shell history-clearing commands designed to obfuscate the malicious activity. This behavior is associated with macOS crypto-drainers and loaders.
Detects the abuse of Visual Studio Code (and compatible IDEs like Cursor) workspace trust to trigger malicious tasks upon opening a folder. This pattern is associated with the 'Void Dokkaebi' (Famous Chollima) threat group's propagation of the 'DEV#POPPER' RAT. The rule identifies instances where the code editor spawns common scripting or network utilities (like PowerShell, curl, or Node.js) with command-line arguments indicative of file downloads or execution, as defined in a local '.vscode/tasks.json' file.
Detects malicious markdown files (SKILL.md) that impersonate agent instruction files. These files contain hidden-content constructs (like CSS display:none, HTML comments, or invisible Unicode characters) combined with common command execution patterns (like curl, wget, or PowerShell encoded commands), characteristic of infostealer campaigns targeting AI agent platforms.
Detects the execution of JavaScript files using Windows Script Host (wscript.exe or cscript.exe) containing specific obfuscated patterns or indicators typically associated with malicious multi-stage dropper payloads. These patterns are indicative of obfuscated code attempting to evade static analysis and security controls during the initial execution phase.
Detects the execution of Node.js processes where the command line contains the argument 'parser.js'. This is often used by adversaries to execute JavaScript-based payloads or custom scripts for malicious purposes.
This rule monitors for the execution of Node.js processes involving a file named 'parser.js' and a component or argument referred to as 'ldata'. This behavior is characteristic of specific application workflows, but when observed as a standalone or unusual process, it may indicate unauthorized script execution or the activity of a malicious node-based tool.
Detects execution of shell scripts where a remote resource is fetched via curl with silent flags and immediately piped into a shell interpreter. This pattern is commonly associated with the delivery of malicious payloads or installation of unauthorized tools.
Detects command-line execution (cmd.exe, powershell.exe) originating from a python.exe process tree, correlated with long-running, frequent outbound public network connections from the same python.exe process. This behavior is consistent with the SynkLoader RAT module, where a loader uses a Python process to execute system commands and maintain persistent C2 channels.
Detects Python or PythonW processes loading an illegitimate 'msvcp150.dll' (masquerading as a Visual C++ redistributable) that simultaneously loads the .NET 'System.Management.Automation' assembly. This behavior is indicative of the SynkLoader technique, where a malicious native DLL is used as a bridge to execute PowerShell commands within the memory space of a Python process, bypassing traditional script-based detection.
This rule detects JavaScript code patterns indicative of the NovaCookies phishing kit, which employs timing-based anti-analysis techniques to detect if a web developer console is open. By checking the execution time of code via a 'clock' function and monitoring for a 'debugger' statement, the kit attempts to withhold the phishing lure from researchers.
Detects the use of PowerShell commands that leverage .NET AES cryptography with CBC mode to decrypt payloads in-memory, subsequently executing the resulting code directly via [System.Management.Automation.ScriptBlock]::Create. This technique is often used to bypass disk-based signature detection.
Detects behavioral indicators associated with the ChocoShell malware, a fileless PowerShell-based infostealer. The rule monitors for malicious command-line activity including AMSI bypass, credential theft from Token Broker and WLAN profiles, disabling of Microsoft Defender signatures, and communication with local API endpoints typical of the CornFlake controller.
Detects the use of common command-line utilities (curl or wget) to download files to a temporary directory (/tmp/helper), initiated from within an interactive shell session (sh, zsh, bash). This pattern is commonly observed during the initial stages of post-exploitation, where threat actors download malicious scripts or tools to a staging directory before execution.
Detects the creation of a shortcut file named 'SystemIn.lnk' using PowerShell, a technique associated with the QUICSILVER malware to establish persistence. The rule monitors for PowerShell command-line arguments involving 'WScript.Shell' and 'CreateShortcut' alongside the specific file name.
Page 55 of 191