Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with suspicious command-line arguments, including references to batch files or execution from user-writable directories like AppData. This behavior is indicative of potential malicious payload execution or installation persistence attempts leveraging the msiexec utility.
Detects the creation of scheduled tasks using the 'schtasks' utility, initiated by suspicious parent processes (browsers, scripting engines, or common tools) or utilizing suspicious task actions (PowerShell, VBScript, etc.) in user-writable directories. Additionally, it flags tasks with high-frequency scheduling or persistence triggers paired with encoded or hidden command-line arguments, which are common indicators of malicious activity such as malware execution or persistence mechanisms.
Detects the execution of hidden shell scripts (.sh or .command) located within a mounted disk image (.dmg). This pattern is commonly used by macOS infostealers which masquerade as legitimate applications (such as Notion, Arc, or Raycast) to trick users into executing malicious code after mounting the deceptive installer.
Detects bash processes executing commands that combine AWS identity verification with outbound exfiltration using curl. The pattern specifically monitors for the use of 'aws sts get-caller-identity' followed by an immediate HTTP POST transmission of data (indicated by '-d @-'), which is characteristic of attackers exfiltrating captured cloud environment metadata or temporary credentials.
Detects the execution of AWS CLI commands by common scripting interpreters (Node.js or Python). This behavior is often indicative of automated cloud environment reconnaissance or credential testing using compromised access keys or instances.
This rule detects activities associated with the TaskWeaver JavaScript loader and its potential second-stage payload, Djinn Stealer. It monitors for JavaScript files (like jquery.js) being executed by Windows scripting hosts (wscript.exe, cscript.exe) or Node.js, identifies suspicious child process spawning behavior (e.g., cmd.exe, powershell.exe, system reconnaissance tools) from these scripting engines, and flags outbound network connections by these processes to common web ports that may indicate command-and-control (C2) communication.
Detects the execution of LuaJit.exe with a config.ini script, which acts as a Lua-based shellcode loader for BeepRAT. The loader uses Lua FFI to call Windows APIs such as VirtualAlloc and CreateThread to execute shellcode stored in temp.bin directly in memory. This pattern is indicative of fileless execution techniques employed by the BeepRAT remote access trojan.
This rule detects instances where OpenVPN-related processes (OpenVPNConnect.exe, openvpn.exe, or openvpnserv.exe) spawn known command-line interpreters or execute scripts containing specific markers related to OpenVPN connectivity and script execution. This behavior is indicative of potential command injection or post-exploitation activity leveraging VPN service privileges.
Detects instances where the SimpleHelp RMM agent process initiates a command interpreter or scripting process. This behavior is often indicative of post-exploitation activity, specifically unauthorized script or command execution delivered via a remote support session.
Detects suspicious behavior originating from OpenVPN processes, including spawning command-line interpreters (cmd, powershell, etc.), utilization of server-pushed configuration directives that trigger script execution (e.g., up, down, or route-up hooks), and the creation of scripts or executables within temporary directories.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.
Detects suspicious network-related activity initiated by common command-line utilities when spawned as child processes of Visual Studio Code (Code.exe). This pattern is often indicative of automated script execution, malware staging, or adversary activity following code repository manipulation, particularly when preceded by a git clone operation within a 15-minute window.
Detects suspicious executions of Python interpreters or Pip package managers originating from common development tools (like VS Code or Node.js) or utilizing temporary file paths. The rule also monitors for suspicious command-line arguments that indicate obfuscation, encoded payloads, or the use of dynamic evaluation functions.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects when a known OpenClaw AI agent process spawns a shell to download and immediately execute a script. This is a common pattern used by malicious "Skills" to establish persistence or run further payloads, as detailed in the NSFOCUS report.
Correlates the use of Impacket scripts (wmiexec.py or smbexec.py compiled variants) executing remote commands via WMI or SMB services on target endpoints. Specifically looks for 'wmiprvse.exe' or 'services.exe' initiating 'cmd.exe' or 'powershell.exe' with command-line arguments indicating local host or administrative share access and redirection to a temporary directory.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. This rule specifically looks for the combination of '-bxor[int][char]$' and '[convert]::ToInt32' within PowerShell command or script block execution events, which is characteristic of the ErrTraffic ClickFix malware distribution framework.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
This rule detects unauthorized configuration of GRE tunnels on Cisco IOS-XE network devices, potentially indicating persistent command and control (C2) channel establishment via TCL injection or illicit configuration changes involving known attacker infrastructure (62.171.185.97). It correlates network traffic to the attacker IP with process-level activity involving suspicious configuration files, scripts, or device-specific command-line arguments.
Page 89 of 191