Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
2
2
1
Categories
4
1
1
1
Platforms
4
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
1
Detects potential exploitation of Motex LANSCOPE Endpoint Manager (CVE-2025-61932). This rule identifies when a process listening on TCP port 443 receives an inbound connection and subsequently spawns a suspicious child process (like cmd.exe or powershell.exe), a behavior consistent with exploiting a remote service vulnerability.
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
This rule detects suspicious user agent strings commonly associated with various Advanced Persistent Threat (APT) groups and malware families. It specifically targets patterns found in proxy logs, indicating potential command and control (C2) communications or other malicious web activity. The rule includes a broad list of user agent strings linked to specific APTs like Backspace, GrizzlySteppe, Comment Crew, Naikon, Sofacy (Xtunnel, Zebrocy), Derusbi, Winnti, APT17, Bronze Butler (Daserf), TSCookie, Delphi downloader, VPNFilter, FELIXROOT, RMS, Cmstar, KerrDown, APT33 (PowerTon), Hidden Cobra, Strong Pity, Mustang Panda, BackdoorDiplomacy, SideWalk, LitePower (WRITE), ZINC, PlugX, and RedCurl.
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.