Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
32
8
6
2
2
Contributors
10
9
7
5
4
Categories
42
22
10
6
5
Platforms
29
17
6
2
2
Products / Services
14
11
9
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
1
1
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects when a process's command line contains 'ssl' or 'tls' and is observed at least 3 times within an hour on the same computer and by the same account. This could indicate various activities, including legitimate system processes, development activities, or potentially malicious use of SSL/TLS-related tools or scripts. The rule focuses on process creation events (EventID 4688) and analyzes the command line arguments.
Detects the configuration of network tunnels or IPsec-related settings using tools such as ip, setkey, racoon, or strongswan by a non-root user. This behavior is indicative of potential unauthorized tunnel establishment or lateral movement activities where a standard user attempts to bypass network controls.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects bulk AWS or Azure API command execution via CLI tools
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
This rule detects when a process's command line contains 'ssl' or 'tls' and is observed at least 3 times within an hour on the same computer and by the same account. This could indicate various activities, including legitimate system processes, development activities, or potentially malicious use of SSL/TLS-related tools or scripts. The rule focuses on process creation events (EventID 4688) and analyzes the command line arguments.
This rule detects an unusually high number of command-line executions containing keywords related to 'dependency' or 'library' and 'update' or 'upgrade' within a one-hour window on a single computer. This behavior could indicate an adversary attempting to modify system components, install malicious libraries, or compromise the software supply chain by frequently updating or upgrading software dependencies.
EchoCreep Sends an Up Success Check-In
Cortex XDR
Detects a Go backdoor or renamed service process emitting the distinctive 'Up Success' runtime message used during Discord channel check-in. This rule specifically looks for network events where the process name matches common system processes (searchapp, service, update) and the command line contains 'Up Success'.
Detects the execution of 'update.bat' from the Temp directory with a minimized window, typically indicating a hidden or background execution of a batch script. This pattern is often used by malware or unwanted applications to perform updates or other actions discreetly.
Detects use of trap command to handle system signals for Linux persistence
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
This rule detects attempts to access a known vulnerable endpoint in Ivanti Sentry appliances, specifically '/mics/api/v2/sentry/mics-config/handleMessage', via an HTTP POST request. This activity is indicative of exploitation attempts related to CVE-2026-10520, which is a pre-authentication OS command injection vulnerability.
This rule detects suspicious access to the UniFi OS JWT secret file (jwt.yaml) by processes other than the legitimate UniFi core components. It monitors for direct file access events (read, copy) and command-line executions that target the jwt.yaml file. This activity could indicate an attempt to extract sensitive credentials, potentially leading to unauthorized access or privilege escalation within the UniFi environment.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects an unusually high number of command-line executions containing keywords related to 'dependency' or 'library' and 'update' or 'upgrade' within a one-hour window on a single computer. This behavior could indicate an adversary attempting to modify system components, install malicious libraries, or compromise the software supply chain by frequently updating or upgrading software dependencies.
Detects process execution events containing command-line arguments unique to Chaos ransomware execution, such as 'ignorar_arquivos_grandes' or 'work_mode'. It also includes a more generic detection for 'lkey' and 'path' arguments used together to reduce false positives.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects an unusually high number of command-line executions containing keywords related to 'dependency' or 'library' and 'update' or 'upgrade' within a one-hour window on a single computer. This behavior could indicate an adversary attempting to modify system components, install malicious libraries, or compromise the software supply chain by frequently updating or upgrading software dependencies.
Detects the execution of the 'tee' command via sudo, potentially indicating local privilege escalation. This activity has been observed in VerdantBamboo campaigns exploiting a sudo misconfiguration for the 'egnyteservice' account on Egnyte Storage Sync systems.
Page 1 of 3