Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of Python or Pythonw processes with command-line arguments that include base64 decoding followed by the exec() function. This pattern is commonly used by adversaries to execute obfuscated or encoded malicious code directly in memory to evade detection.
This rule detects potentially malicious command execution (RCE) originating from AI orchestration platforms and development runtimes (such as Ollama, LangChain, AutoGen, CrewAI, n8n, Node.js, and Python). It flags instances where these processes spawn command shells (cmd.exe, powershell.exe, bash, sh) and execute suspicious command-line patterns indicative of code injection or command execution (e.g., eval(), exec(), subprocess, child_process). The rule uses a threshold of 3 or more occurrences in a 15-minute window per device and process to reduce noise.
Detects the execution of LOLBins (PowerShell, mshta, cmd, wscript) directly spawned from common web browsers (explorer, chrome, edge, firefox) with command-line arguments indicative of malicious activity, such as base64-encoded commands, hidden window styles, or remote script download and execution.
Detects the execution of the Bun JavaScript runtime by npm or node.js during lifecycle tasks (preinstall, postinstall, etc.). This behavior is highly indicative of the ChainDrop/Shai-Hulud supply chain worm, which uses npm lifecycle scripts to download and execute a second-stage payload using the Bun runtime.
This rule detects network connections from common administrative processes (such as PowerShell, CMD, WScript, or Rundll32) to known dynamic DNS providers. This pattern is frequently indicative of malware beacons, command and control (C2) communication, or other unauthorized remote access tools utilizing dynamic DNS services to maintain connectivity to adversary infrastructure.
Detects malicious JavaScript execution patterns identified by AMSI that contain suspicious obfuscation (hex-encoded shellcode patterns and immediate function execution wrappers) occurring within Node.js or VSCode related processes.
This rule detects potential multi-stage desktop takeover attacks by monitoring sequences of process execution within a 5-minute window. It looks for initial shell (explorer.exe or cmd.exe) spawning script-based tools (mshta.exe, wscript.exe, cscript.exe, powershell.exe, cmd.exe) with suspicious command-line arguments (extensions like .lnk, .url, .hta, or PowerShell-specific artifacts like 'IEX', 'DownloadString', or '-enc'). This is immediately followed by a secondary stage where PowerShell, cmd, or rundll32 are used to load external DLLs, register modules via regsvr32, or interact with AppData/Local/Temp directories, indicative of payload staging and execution.
This rule detects the execution of scripts or processes containing command-line arguments indicative of a cryptocurrency wallet drainer (e.g., 'DRAIN', 'DRAIN_PCT') targeting specific cryptocurrencies (bitcoin, ethereum, etc.). These scripts are commonly used by threat actors to exfiltrate funds from victim crypto wallets.
Detects the execution of malicious 'node.exe' processes that invoke 'setup.mjs' or 'math_init.js' scripts from within .vscode or .claude configuration directories. This pattern is characteristic of the ChainDrop/Shai-Hulud npm supply chain worm, which leverages VS Code tasks or Claude Code session hooks to achieve persistent execution of dropper scripts without triggering standard npm installation flows.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
Detects execution of potentially malicious JavaScript files (e.g., setup.mjs, math_init.js) via Node.js or Bun command-line tools. This often indicates the execution of obfuscated or unauthorized scripts during software installation or supply chain compromise attempts.
Detects dropper/staging scripts that curl-fetch a second-stage Mach-O payload to /tmp/helper or /tmp/update, chmod +x it immediately afterward in the same command sequence, ad-hoc/unsigned sign it, and strip quarantine attributes, while excluding scripts that verify a legitimate Developer ID signature
Detects instances where a Java process (typically a web application server like Tomcat) initiates suspicious command-line tools such as cmd.exe, powershell.exe, or various Linux shell binaries, using command-line arguments indicative of a reverse shell or code execution (e.g., -e /bin/sh, -i, /dev/tcp, IEX, DownloadString). This pattern is commonly associated with exploit attempts targeting vulnerabilities like Java deserialization.
This rule detects potentially malicious command-line execution patterns often observed in 'ClickFix' or similar clipboard-based attack campaigns. It monitors for instances where standard Windows interpreters (PowerShell, cmd.exe, mshta.exe) are launched by legitimate shell processes (explorer.exe, rundll32.exe) and execute specific commands (like certutil for decoding) to process content found in suspicious or user-writable locations such as AppData or containing file extensions like .png (often used for steganography or file hiding).
This rule detects network connections from common administrative processes (such as PowerShell, CMD, WScript, or Rundll32) to known dynamic DNS providers. This pattern is frequently indicative of malware beacons, command and control (C2) communication, or other unauthorized remote access tools utilizing dynamic DNS services to maintain connectivity to adversary infrastructure.
Detects the execution of JavaScript files via Windows Script Host (wscript.exe or cscript.exe) where the command line contains an unusually long base64-encoded string. This pattern is often indicative of a dropper or loader script deobfuscating and executing a subsequent malicious payload in memory.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects the execution of AppleScript files (.scpt) using the osascript command-line utility on macOS. Adversaries often use AppleScript to execute commands, interact with applications, or perform malicious actions on a system.
Detects anomalous scheduled task execution by identifying processes named 'csvchost.exe' or 'psvchost.exe' that reference GoogleUpdateService or MSEdgeUpdateService task names containing GUID patterns. It further correlates this with suspicious command-line indicators such as 'App.py' references, 'WakeToRun' flags, '-headless' flags, or PowerShell bypass techniques, which are associated with the delivery of CountLoader and DeviceManager RATs in DOUBLECUP campaigns.
Detects execution of potentially malicious JavaScript files (e.g., setup.mjs, math_init.js) via Node.js or Bun command-line tools. This often indicates the execution of obfuscated or unauthorized scripts during software installation or supply chain compromise attempts.
This rule detects account and credential enumeration activities using the macOS 'dscl' (Directory Service Command Line) utility. It specifically monitors for 'dscl' commands ('-list /Users', '-read', or '-authonly') being invoked by unsigned shell scripts (sh, bash, zsh) or scripts running from suspicious locations like '/tmp/', '/private/tmp/', '/private/var/folders/', or '/Downloads/'. The rule effectively identifies potential reconnaissance or credential harvesting attempts often associated with malicious macOS 'clickfix' campaigns.
Page 57 of 191