Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects modifications to the Winlogon Shell registry key or a specific 'MyStartupScript' registry Run key. These locations are commonly abused by the LCRYX ransomware to establish persistence via VBScript or script host execution. The rule monitors both EDR registry events and Sysmon event ID 13 for suspicious changes performed by script host processes or targeting these specific persistence locations.
Detects the post-download execution stage of the abdrizak PostCSS typosquatting Windows RAT campaign. Covers three indicators: (1) wscript.exe executing a .vbs file from %TEMP% or subdirectory (e.g. update.vbs from winPatch), (2) chost.exe or any process launching loader.py as a command-line argument, (3) cmd.exe using tar to extract a .zip archive from %TEMP%.
This rule detects potentially malicious child processes spawned by Amazon Q or VS Code language server processes. It monitors for suspicious shell command-line invocations (e.g., bash, sh, cmd.exe) or tools (npx, python) immediately following the activation of language server processes, specifically looking for patterns associated with the unauthorized auto-loading or execution of Model Context Protocol (MCP) configuration files or utilities, potentially related to vulnerability patterns involving workspace-based execution.
Detects the Ghidra reverse engineering suite spawning suspicious child processes such as command shells, scripting interpreters, or network utilities. This activity often indicates an attempt to automate reverse engineering tasks or interact with the system in an unintended manner by potentially malicious scripts or plugins.
Detects a git clone operation performed in a potentially untrusted or sensitive directory (e.g., Desktop, Downloads, Temp) followed immediately by code execution using common interpreters (node, python, powershell). This behavior is consistent with the Lazarus Group 'Contagious Interview' campaign, where attackers lure developers into cloning and executing malicious code repositories via social engineering.
This rule detects suspicious process execution patterns that are characteristic of fileless malware execution or malicious script handling. It specifically targets PowerShell commands using ReadAllText to read script content from stdin/env:0, the use of Sysnative paths for architectural bypasses, and the execution of setup.cmd files from 7Zip extraction directories.
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects the execution of malicious LNK files (masquerading as image files) that trigger PowerShell scripts, or the subsequent execution of non-Microsoft signed Node.exe binaries from suspicious directories, characteristic of the TonRAT campaign.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) scripts that contain patterns indicating evasion techniques. Specifically, this rule identifies the combined use of execution delays (e.g., Start-Sleep, WScript.Sleep, ping/timeout) and environment/sandbox fingerprinting (e.g., WMI queries for ComputerSystem, hypervisor detection, or CPUID) often used by malware to detect virtual environments before executing malicious payloads (typically via IEX or Invoke-Expression).
Detects Node.js executing the malicious 'setup.cjs' script with the '--no-warnings' flag. This execution sequence is associated with the 'easy-day-js' typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the hallmark of a ClickFix attack: a user tricked by a fake error message into pasting a PowerShell command into the Run dialog (explorer.exe), which accesses the clipboard. Specifically, it looks for PowerShell commands initiated by explorer.exe that contain 'Get-Clipboard', 'iwr' (Invoke-WebRequest), or 'iex' (Invoke-Expression).
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing, which are indicative of malicious discovery.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) where the initiating parent process is not a common legitimate process like explorer.exe, cmd.exe, powershell.exe, svchost.exe, or system.exe, and is also not a web browser (Chrome or Firefox). This pattern can indicate an attempt to execute malicious VBScript or JScript files, potentially delivered via phishing, where the script is launched by an unusual or obfuscated parent process to evade detection.
Detects suspected command and control (C2) activity leveraging Cloudflare Tunnel or Workers. The rule identifies two patterns: 1) Repeated polling (>5 connections in 10 minutes) to Cloudflare infrastructure by suspicious scripting processes (e.g., PowerShell, WScript), and 2) A 'dead-drop' resolver pattern where a process contacts a Cloudflare domain, followed by a DNS query to an unrelated domain shortly thereafter, suggesting the retrieval of a new C2 address.
Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex'.
Detects the deletion of specific files associated with Mistic sideloading artifacts ('EndpointDlp.dll' or 'MpExtMs.exe') using command-line utilities such as cmd.exe or PowerShell. This behavior is indicative of an adversary attempting to remove forensic traces or secondary payloads after initial compromise.
Detects automated payroll fraud attempts by monitoring for scripting engines initiating HTTP connections to known payroll platforms (e.g., Workday, ADP) or spawning child processes with payroll-related command-line arguments. This behavior is indicative of post-AiTM session abuse, where attackers manipulate financial accounts or automate unauthorized payroll changes via malicious scripts.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
Page 80 of 191