Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of unsigned JavaScript (.js) files using the Windows Script Host (wscript.exe). Adversaries often use JavaScript for initial execution or as a secondary payload, and obfuscation is commonly applied to these scripts to evade detection.
Detects instances where VS Code (Code.exe) or Node.js (node.exe) processes reference CI/CD-related environment variables in their command line. This behavior is often associated with build pipeline manipulation, credential harvesting from environment configurations, or post-exploitation activities within developer environments.
Detects instances where a Java process (typically a web application server like Tomcat) initiates suspicious command-line tools such as cmd.exe, powershell.exe, or various Linux shell binaries, using command-line arguments indicative of a reverse shell or code execution (e.g., -e /bin/sh, -i, /dev/tcp, IEX, DownloadString). This pattern is commonly associated with exploit attempts targeting vulnerabilities like Java deserialization.
This rule detects potentially malicious command-line execution patterns often observed in 'ClickFix' or similar clipboard-based attack campaigns. It monitors for instances where standard Windows interpreters (PowerShell, cmd.exe, mshta.exe) are launched by legitimate shell processes (explorer.exe, rundll32.exe) and execute specific commands (like certutil for decoding) to process content found in suspicious or user-writable locations such as AppData or containing file extensions like .png (often used for steganography or file hiding).
This rule detects the multi-stage execution pattern characteristic of the AMOS stealer on macOS, where a terminal session is used to execute a base64-encoded payload piped into a shell interpreter. The rule specifically monitors for processes like curl, openssl, base64, and zsh being launched from a Terminal or shell parent, often involving specific command-line indicators or malicious URLs associated with the stealer's toolkit.
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
Detects malicious script execution triggered by the CVE-2026-42897 XSS vulnerability in Outlook Web Access (OWA). The detection rule monitors AMSI script detection events for patterns associated with the OWAReaper exploit chain, which utilizes an 'onload=eval(atob())' loader to reconstruct a base64-encoded payload embedded in social-icon image tags within a browser session.
Detects the creation and subsequent execution of AppleScript files (.scpt) using the 'osascript' command-line utility on macOS. This pattern is commonly used to automate tasks, but can be leveraged by attackers for malicious payload execution or system interaction.
Detects anomalous, high-volume access, download, or synchronization activity in SharePoint or OneDrive within a one-hour window. The rule focuses on non-interactive user agents typically used by scripting libraries (e.g., Python requests, PowerShell, Go-http-client) and flags activity that exceeds an individual user's 21-day rolling baseline, suggesting potential automated data exfiltration or mass collection.
Detects the use of 'curl' to perform a network request (likely for a remote script) and immediately piping that output to 'osascript' for execution in memory. This pattern is often used to execute malicious AppleScript payloads directly without writing to the disk, a technique seen in recent macOS infostealer campaigns.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects the execution of cmd.exe, powershell.exe, or pwsh.exe launched directly from Windows Explorer (explorer.exe) where the command line contains obfuscated arguments, long encoded strings, or specific indicators associated with common click-based execution attacks.
Detects the execution of 'certighost.py', a Python-based tool used to exploit CVE-2026-54121. The detection monitors process command lines for the specific script name in combination with command-line arguments (such as --dc-ip, --template, --computer-name, etc.) used to abuse the AD CS chase enrollment flow for malicious certificate requests.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
This rule detects when common administrative or networking tools such as bash, sh, cmd.exe, powershell.exe, curl, or wget are initiated by Langflow application processes (python, uvicorn, gunicorn). This behavior is indicative of potential command injection or exploitation of the Langflow platform to execute unauthorized commands or download malicious payloads.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects instances where Veeam ONE Agent components (VeeamOneAgent, VeeamOneWebService, or VeeamOneReportingSvc) initiate common command and scripting interpreters like cmd.exe, powershell.exe, cscript.exe, or wscript.exe. This activity is often indicative of potential exploitation of the backup management software or administrative abuse.
Detects a VBS script invoking PowerShell to decode a Base64 payload, write it to disk with a random name, and decompress it using IO.Compression.GzipStream into tmp*.bat.gz/tmp*.bat files, consistent with the AutoIT-based VIPKeylogger/MedusaHVNC infection chain.
Page 58 of 191