Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects a multi-stage execution chain involving a malicious LNK file that triggers PowerShell. The rule specifically looks for PowerShell commands spawned by explorer.exe or mshta.exe that contain indicators of string deobfuscation (using .Replace), specific job-related keywords (CoreJob), or remote content retrieval (Net.WebClient.DownloadString). The detection correlates these process events with the presence of suspicious LNK files and decoy document files dropped within the temporary directory on the same endpoint.
This rule detects the use of 'osascript' on macOS to execute commands that interact with the 'AccountsHelper' process, specifically using 'stat' to probe /dev/console and 'sudo -u' for privilege elevation or user context switching. This pattern is indicative of unauthorized attempts to interact with system account management utilities or sensitive user processes.
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
Detects instances where Veeam ONE Agent components (VeeamOneAgent, VeeamOneWebService, or VeeamOneReportingSvc) initiate common command and scripting interpreters like cmd.exe, powershell.exe, cscript.exe, or wscript.exe. This activity is often indicative of potential exploitation of the backup management software or administrative abuse.
This rule monitors the Windows Registry 'RunMRU' key for entries that include command execution patterns such as 'cmd.exe' or '%COMSPEC%' combined with suspicious arguments like 'finger' or 'cmd /c'. The RunMRU key stores the history of commands entered into the Windows 'Run' dialog, and this detection identifies potentially malicious command execution patterns often associated with malware loaders attempting to run secondary payloads or obfuscated commands via the shell history.
This rule detects when common administrative or networking tools such as bash, sh, cmd.exe, powershell.exe, curl, or wget are initiated by Langflow application processes (python, uvicorn, gunicorn). This behavior is indicative of potential command injection or exploitation of the Langflow platform to execute unauthorized commands or download malicious payloads.
Suspicious Script and Utility Execution
Cortex XDR
This rule detects the execution of common command-line interpreters and utility tools frequently abused by attackers for reconnaissance, execution, and post-exploitation activities. Monitored binaries include script interpreters (python.exe, powershell.exe, pwsh.exe, bash.exe, sh.exe) and command-line utilities (cat, grep, find).
Detects the execution of suspicious commands, PowerShell scripts, or LOLBins (Living-off-the-Land Binaries) - commonly seen in ClickFix and CrashFix campaigns - recorded in the Windows 'RunMRU' registry key.
Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.
This rule detects suspicious process execution where PowerShell (powershell.exe) spawns a Python interpreter (python.exe or pythonw.exe) located in an AppData\Roaming directory. It specifically flags instances where the command line of the invoked process includes both a reference to the AppData\Roaming directory and a Python script (.py) file, which is a common behavior for loaders like CastleLoader attempting to execute scripts from user-writable directories.
Detects execution or file drop of the GHOSTBLADE keychain-dumping module (keychain_copier.js) or its parent implant (ghostblade.js) on a device following DarkSword iOS exploit-chain compromise.
Detects scheduled task creation or execution masquerading as GoogleUpdateService or MSEdgeUpdateService with a GUID suffix, combined with anomalous payload indicators such as csvchost.exe, psvchost.exe, App.py, python-3.13.13-embed-amd64.zip, or WakeToRun=$true, associated with the DOUBLECUP loader delivering the DeviceManager RAT.
This rule detects when common web browser processes spawn command-line shells or scripting interpreters. This behavior is often indicative of malicious browser extensions, browser exploitation, or remote code execution attempts, as browsers generally should not be launching native system shells.
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Detects reconnaissance of system security posture by unsigned or unknown processes. The rule monitors for a combination of AV/EDR product enumeration (SecurityCenter2, Windows Defender exclusion queries), RDP history collection, Office MRU collection, and general system information gathering. It correlates two or more of these activities originating from the same process within a 15-minute window, while excluding known legitimate security and management software.
Detects the SourTrade browser-side build-pipeline setup sequence: a ServiceWorker registered at /sw.js immediately followed, within the same page load, by a SharedWorker instantiated from an in-page Blob URL carrying an application/javascript MIME type — restricted to domains flagged as newly-registered or low-reputation — consistent with the pre-download preparation stage of browser-assembled malware.
Detects persistence achieved via a shortcut (.lnk) file created in a user's Startup folder that launches an AutoHotkey script. The rule specifically looks for AutoHotkey processes executing scripts from common writable locations (Temp, AppData) with command-line arguments referencing functions (CheckHeadlessEdge, FindAndRunTask) associated with the SNOWBELT loader and UNC6692's Edgecution malware suite.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Page 59 of 191