Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects a multi-stage execution chain associated with the 'Contagious Interview' campaign, where Visual Studio Code (Code.exe) spawns a shell process (cmd, powershell, bash, or sh) that uses network retrieval utilities (curl, wget, or http) to download content from known Lazarus group staging domains within a two-minute window.
Detects instances where explorer.exe (acting as a parent process due to a user executing commands via the Win+R Run dialog) spawns common command-line interpreters or script hosts (powershell.exe, cmd.exe, mshta.exe, wscript.exe) with suspicious command-line arguments indicative of malicious activity, such as encoded commands, downloader patterns, or file execution proxies. This pattern is consistent with ClickFix-style social engineering attacks where users are tricked into copying and pasting malicious payloads from a webpage into the Run dialog.
Detects instances where common web browsers initiate secondary processes such as command-line interpreters (cmd.exe, powershell.exe) or scripting engines (wscript.exe, cscript.exe, mshta.exe). This pattern is frequently indicative of drive-by download attacks or initial access where an adversary uses web browser activity to execute malicious scripts or commands.
Detects the execution of AppleScript files named 'Maccy.scpt' using the 'osascript' or 'Script Editor' utilities. The rule correlates this process execution with network activity directed towards the 'maccyapp.com' domain within a one-hour window, identifying potential unauthorized or malicious scripting behavior involving Maccy-related artifacts.
Detects the short-lived execution of an AppleScript file named 'Maccy.scpt' using the Script Editor application. This pattern of execution, characterized by very brief process lifetimes, is often associated with automated tasks or potential abuse of AppleScript for command execution.
This rule detects potentially unauthorized or suspicious outbound network connections to common Generative AI service APIs (OpenAI, Anthropic, Mistral) originating from command-line interpreters (cmd.exe, powershell.exe) or python.exe instances running from temporary directories, which could indicate data exfiltration or the use of AI tools for malicious automation.
Detects instances where Python-related package management tools (python.exe, pip.exe) initiate external network connections shortly after executing install-related commands. This behavior may indicate an attempt to install malicious packages from untrusted repositories or a software supply chain compromise.
Detects instances where Python-related package management tools (python.exe, pip.exe) initiate external network connections shortly after executing install-related commands. This behavior may indicate an attempt to install malicious packages from untrusted repositories or a software supply chain compromise.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
Detects suspicious use of winget.exe and its associated COM API components (ConfigurationRemotingServer.exe and WindowsPackageManagerServer.exe). The rule monitors for unauthorized child process spawning (e.g., cmd.exe, powershell.exe) by the package manager, execution of manual configuration activation via COM, and use of winget to pull external YAML configurations or non-standard file types, which may indicate software supply chain compromise or abuse of system management tools for payload delivery.
Detects AI coding extensions (e.g., Cursor, Windsurf, Claude) spawning Node.js or Python child processes to execute potential Model Context Protocol (MCP) server configurations located in non-standard, potentially untrusted workspace paths. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-12957, where adversaries leverage MCP to gain unauthorized command execution.
Detects wscript or cscript executing shell commands (del/delete) to remove .jse files. This pattern is commonly associated with malicious scripts attempting to clean up traces of their execution after running from temporary locations.
Detects instances where VS Code (Code.exe) spawns interpreter processes (node, python, cmd, powershell, sh, bash) after opening a workspace containing a suspicious tasks.json file. This pattern is consistent with the abuse of VS Code task automation features to gain initial code execution, similar to campaigns targeting developers through malicious repository cloning.
Detects anomalous Python activity indicative of the InvisibleFerret backdoor, specifically focusing on instances where Python processes are spawned by developer tools (node.exe, code.exe, cursor.exe), access sensitive credential/wallet files, or initiate outbound network connections on common C2 ports.
Detects Python interpreters launched by development tools (like VS Code or Node) that execute commands containing obfuscated code, base64-encoded strings, or strings indicative of credential harvesting and clipboard interaction, which may indicate malicious activity or post-exploitation behavior.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
This rule detects PowerShell command lines that contain indicators associated with AMSI (Antimalware Scan Interface) bypass techniques and low-level memory manipulation methods, such as 'VirtualProtect' and 'GetFunctionPointer' used in conjunction with 'RuntimeHelpers'. These techniques are commonly used by attackers to subvert defensive security mechanisms and execute malicious code in memory.
Detects a suspicious process execution chain where explorer.exe or userinit.exe spawns cmd.exe, which in turn launches PowerShell to execute a hidden, bypassed, and obfuscated script involving content retrieval from the C:\ProgramData directory. This pattern is characteristic of the UAC-0226 GIFTEDCROOK actor's persistence mechanism using LNK files.
This rule detects attempts to disable the Antimalware Scan Interface (AMSI) in PowerShell by patching sensitive exported functions (AmsiScanBuffer, AmsiScanString, WinScanContent) within the process memory. Attackers use techniques like VirtualProtect and Marshal.Copy or JIT-compilation via RuntimeHelpers.PrepareMethod to overwrite these functions, effectively forcing AMSI to return an 'AMSI_RESULT_CLEAN' result for all scanned content.
Detects the execution of scripting interpreters and remote management tools originating from the SimpleHelp RMM process tree. This activity is indicative of post-exploitation abuse where an attacker, having hijacked a technician session (e.g., via CVE-2026-48558 OIDC bypass), uses the RMM console to execute commands on remote endpoints.
Detects the use of living-off-the-land binaries (LOLBins) such as PowerShell, curl, certutil, bitsadmin, or mshta to download potential secondary payloads from self-hosted GitLab instances. This behavior is indicative of the Amadey loader chain, where compromised GitLab infrastructure is used as a repository to stage and distribute StealC or other malicious payloads.
Page 68 of 191