Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects instances where the Ghidra reverse engineering suite (or associated Java processes running Ghidra components) initiates suspicious child processes. This behavior is considered anomalous as standard reverse engineering activities in Ghidra should not require the execution of system administrative tools, interpreters, or networking utilities, which may indicate an attacker using a compromised development environment to launch secondary payloads or tools.
Detects the installation of 'cloudflared.exe' as a Windows service from a non-standard file path. The rule specifically correlates this service installation with preceding PowerShell commands typically used to download remote files, consistent with tradecraft observed in Akira and Bumblebee campaigns to establish covert C2 tunneling.
Detects potential BaoLoader drive-by compromise attempts by monitoring two stages: first, the creation of executable files in temporary or application data directories by browser processes; and second, the execution of command-line shells by processes running from those same directories where the browser acted as the grandparent.
Detects instances where common web browsers (Chrome, Edge, Firefox, Brave) spawn command-line tools or script interpreters (cmd, PowerShell, wscript, mshta) as child processes. This behavior is highly indicative of drive-by download attacks, including the 'ClickFix' technique, where users are socially engineered into executing malicious commands under the guise of fake browser updates or error resolution.
Detects unauthorized usage of the 'osascript' command to interact with the 'security' binary on macOS, specifically targeting keychain operations such as dumping, finding generic passwords, or unlocking the login keychain. This behavior is indicative of Meow RAT attempting to exfiltrate credentials from the macOS Keychain or browser-stored secrets.
Detects evidence of the execution of a proof-of-concept (PoC) exploit targeting Next.js unstable_cache functionality. The rule monitors for the installation of canary versions of Next.js, execution of the PoC demonstration script 'run_demo.mjs', and the creation of a 'VULNERABILITY_CONFIRMED.marker' file, which are specific indicators associated with the exploitarium repository PoC.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects attempts by LCRYX ransomware to disable security protections, including Windows Defender real-time monitoring and firewall, as well as third-party antivirus software (Bitdefender, Kaspersky). The detection monitors process creation events for malicious command-line arguments, excluding legitimate administrative processes like msiexec.exe or services.exe.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
Detects the execution of VBScript processes (wscript.exe/cscript.exe) that interact with WMI to enumerate installed antivirus products or perform external IP geolocation lookups via services like ip-api.com. This behavior is indicative of the Grandoreiro banking trojan performing environment reconnaissance and victim-targeted execution.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically focusing on DLL side-loading from user-writable directories (AppData, Temp, Downloads) and the execution of randomized executables spawned by wscript.exe, which is characteristic of its VBS dropper mechanism.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects the Flowise application launching a Node.js child process with a --require flag, which indicates an attempt to exploit an environment variable case-sensitivity bypass (e.g., node_options vs NODE_OPTIONS) in the MCP environment to preload malicious JavaScript code.
Detects the execution of common command-line utilities (cmd, powershell, wscript, cscript, mshta, certutil) directly spawned by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This is a common indicator of macro-based attacks or other exploit delivery chains where Office documents are used to execute malicious payloads.
This rule detects the use of 'wmic.exe' with the '/format' switch to execute XSL files, or the direct execution of 'msxsl.exe'. These methods are common techniques used by adversaries to bypass security controls by executing arbitrary scripts embedded within XSL files, often fetched from remote locations or local paths.
Detects suspicious activity on Cisco SD-WAN infrastructure (vManage, vSmart, vBond) associated with unauthorized configuration changes, potential exploitation of CVE-2026-20245, rogue account creation, and anti-forensic behaviors.
Detects AMOS malware presenting a fake System Preferences password dialog via osascript to harvest user credentials, followed by validation using dscl -authonly. This is a key technique in the macOS ClickFix campaign delivering Atomic macOS Stealer.
Detects instances where common Windows system processes (dllhost.exe, mmc.exe, svchost.exe) spawn known living-off-the-land binaries (LotLBin) or command-line interpreters. This behavior is often indicative of process injection or malicious activity where an adversary leverages trusted system processes to execute commands or malicious scripts.
This detection identifies a pattern associated with the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.
Detects instances where the Windows script hosts wscript.exe or cscript.exe establish outbound network connections to common web ports (HTTP/HTTPS) on external IP addresses. This behavior is frequently associated with script-based malware, droppers, or C2 beacons.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing.
Page 81 of 191