Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
141 detections
Filters
Last updated
All Time
Detection languages
53
43
14
13
8
Contributors
34
28
16
10
8
Categories
102
100
43
23
13
Platforms
141
4
1
1
Products / Services
46
40
29
10
10
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects a web server process spawning tools commonly used for data staging and exfiltration, such as rar.exe, certutil.exe, and type.exe. This behavior is characteristic of the CL-UNK-1068 actor's exfiltration TTP, often performed via a web shell.
Detects a Java process starting certutil to download a file from the internet. This is unusual for a message broker and can indicate a server has been taken over and is pulling down a payload.
Detects the use of certutil.exe to decode a batch script that is referencing itself as the source file. This is a 'fileless' technique used by attackers to hide and extract embedded payloads, as seen in the 'Contagious Interview' campaign.
This rule detects various stages of an attack chain, starting from an Apache ActiveMQ exploit (CVE-2023-46604) leading to LockBit-style ransomware. It identifies process creation anomalies (java.exe spawning certutil.exe for downloads), network connections to known Metasploit C2 infrastructure, the presence of specific ransomware file hashes, and attempts to clear Windows event logs, all indicative of the described attack scenario.
Detects Claude Code spawning suspicious child processes, consistent with abuse of project configuration hooks or MCP initialisation commands.
Detects a Java process spawning a command shell to download a file using the certutil.exe utility. This behavior was observed in the exploitation of Apache ActiveMQ (CVE-2023-46604), where the threat actor used this technique to download a secondary payload.
This rule detects the creation of scheduled tasks (`schtasks.exe /create`) where the command line arguments contain suspicious executables or paths commonly associated with malicious activity. This indicates a potential persistence mechanism being established by an adversary.
Detects script engines using common download or decoding primitives that frequently appear in staged malware delivery.
This rule detects suspicious Spring bean XML content, specifically looking for indicators related to the exploitation of Apache ActiveMQ CVE-2023-46604. It targets XML payloads that attempt to execute commands using 'ProcessBuilder' and download files via 'certutil -urlcache' from an HTTP source, consistent with observed attack patterns.
This rule set detects attempts to download an 'install.sh' script from the domains 'clawd.bot' or 'openclaw.ai' using various methods. The first rule, 'openclaw_curl_install_script', specifically targets command-line tools like curl, wget, aria2c, and fetch. The 'openclaw_powershell_download' rule focuses on PowerShell commands (Invoke-WebRequest, iwr, Invoke-RestMethod, irm) used for downloading. The 'openclaw_aria2c_fetch_download' rule is redundant with the first rule, as it also targets aria2c and fetch. The 'openclaw_lolbin_download' rule identifies the use of Living Off The Land Binaries (LOLBins) such as certutil, bitsadmin, and mshta for the same download activity. Finally, the 'openclaw_http_install_sh' rule detects direct HTTP network requests to the 'install.sh' path on these domains. Collectively, these rules aim to identify potential initial access or execution attempts involving a suspicious installation script from specific domains.
This rule detects suspicious `conhost.exe` processes executing with the `--headless` argument and other indicators commonly associated with malware or malicious activity. The presence of `--headless` suggests an attempt to hide the console window, while additional command-line arguments like `svchost.exe`, `certutil -decode`, paths within `Users\Public` or `AppData`, and specific file extensions (`.ico`, `.png`) or keywords (`MRB_`, `DA_NEW_VER_`, `BOT`) further indicate potential compromise. The rule also looks for initiating processes like `cmd.exe`, `powershell.exe`, `curl`, or `start` which are often used to launch malicious payloads.
This rule detects suspicious outbound network connections to Cloudflare Workers domains, indicative of potential command and control (C2) activity. It identifies connections to known malicious Cloudflare Workers domains or IPs, as well as generic Cloudflare Workers domains (.workers.dev) when initiated by suspicious processes like `WsusService.exe`, `curl.exe`, `certutil.exe`, `bitsadmin.exe`, `Velociraptor.exe`, or `msiexec.exe`. The rule prioritizes detection based on specific indicators like known malicious workers or C2 IPs, and flags activity from processes commonly abused for C2 or payload delivery. It also provides severity scoring and investigation steps based on the identified threat type.
This rule detects suspicious child processes spawned by 'WsusService.exe', which is indicative of successful exploitation of a vulnerability like CVE-2025-59287. The rule specifically looks for the WSUS service initiating common command-line utilities such as cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe, and msiexec.exe, which are often used for post-exploitation activities like command execution, downloading additional payloads, or system manipulation. The severity is dynamically assigned based on the spawned process, with download utilities like curl.exe, certutil.exe, and bitsadmin.exe being flagged as 'Critical'.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, Publisher, Visio, Access) spawns a suspicious child process. The child processes include commonly abused Windows utilities such as PowerShell, cmd, wscript, cscript, mshta, rundll32, certutil, bitsadmin, and regsvr32. This behavior can indicate malicious code execution originating from an Office document, often associated with phishing or document-based malware.
This rule detects suspicious command-line activity involving 'conhost.exe' running in headless mode, combined with specific keywords often associated with malware or malicious scripts. The presence of '--headless' with other suspicious strings like 'svchost.exe', 'certutil -decode', common temporary directories, or specific file extensions/initiating processes (cmd.exe, powershell.exe, curl) suggests an attempt to execute hidden or obfuscated malicious code. This pattern is frequently observed in various stages of an attack, including execution, persistence, and defense evasion.
This rule detects attempts to establish persistence by modifying the 'RunMRU' registry key to execute malicious commands. It specifically looks for the presence of common scripting and download utilities (powershell, pwsh, mshta, certutil, bitsadmin, curl, wget) combined with indicators of remote execution or code download (http, iex, Invoke-Expression, DownloadString, iwr, Invoke-WebRequest) within the registry data.
This rule detects attempts to use the Windows registry key 'Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths' to execute potentially malicious commands. It specifically looks for the presence of 'powershell', 'mshta', 'certutil', 'curl', 'bitsadmin', or 'wget' within the registry data associated with this key. This technique can be used for persistence or execution of malicious payloads.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects the use of certutil.exe to decode a payload from a file with a misleading extension (e.g., .png) and save it as a DLL in a suspicious location. This technique was observed in the 'Operation Hanoi Thief' campaign.
This rule detects command-line activity indicative of downloading payloads from a Cloudflare Tunnel (`.trycloudflare.com`). This technique is used by the SERPENTINE#CLOUD threat actor to deliver malicious stages of their attack chain. The rule looks for common download utilities or specific WebDAV paths being invoked by command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe.
Detects the use of certutil.exe for encoding or decoding temporary or cabinet files, a technique used by Kimsuky to obfuscate and stage data for exfiltration.
Page 4 of 7