Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
This rule detects suspicious command-line obfuscation techniques by monitoring process creation events (EventID 4688) for specific patterns in the command line. It looks for the use of environment variables like %TEMP% or %SystemRoot%, the `${env:` syntax, and nested `cmd /c "cmd /c"` calls. These patterns are often used by adversaries to hide the true nature of executed commands, evade detection, or bypass security controls. The rule triggers if three or more such events are observed from the same computer and account within a one-hour window.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
This rule detects a high volume of PowerShell or Command Prompt executions from a single computer by a single account within a one-hour window. This behavior can be indicative of an APT-style multi-stage attack pattern where an adversary is executing numerous commands in quick succession, potentially for discovery, execution, or privilege escalation. The rule specifically looks for command lines containing 'powershell' and '-enc' (encoded command) or 'cmd' and '/c' (execute command and terminate).
Detects indicators associated with the MiniUpdate RAT deployed by the threat group Screening Serpens. This rule identifies network connections to known C2 domains, the creation of a persistence scheduled task named 'WindowsSecurityUpdate', and the dropping of specific RAT module DLLs ('UpdateChecker.dll', 'InitInstall.dll', 'Updater.dll') in common user-writable directories. The file event detection is tuned to require multiple generic DLLs or the presence of 'InitInstall.dll' to reduce false positives.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
This rule detects attempts to download a payload that contains an MSBuild inline task. It specifically looks for HTTP traffic (flow:to_client,established) containing the case-insensitive strings "<UsingTask" and "TaskFactory" within the file data. This pattern is indicative of an attacker attempting to leverage MSBuild's inline task functionality to execute arbitrary code, often as part of a larger attack chain for code execution or persistence.
This rule detects an attempt to escalate privileges on a system via SSH by looking for the string "sudo su" within an established TCP connection to port 22 (SSH). This indicates a user is trying to switch to the root user or another user with elevated privileges using the sudo command.
his detection identifies suspicious execution of update.exe processes launched by svchost.exe from user-writable directories such as AppData, Temp, Downloads, and Public folders.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
Detects the execution of the windowless Java runtime (javaw.exe) originating from the C:\ProgramData\ directory. Threat actors, such as those deploying Nimbus RAT, often drop a bundled Java Runtime Environment (JRE/JDK) in ProgramData to evade detections that monitor standard Java installation paths.
Detects instances where node or Electron processes are executed with the ELECTRON_RUN_AS_NODE environment variable set to 1. This technique is used by UNK_DeadDrop to turn an editor into a plain Node.js interpreter for stealthy payload execution.
Scripting Interpreter Exec
Cortex XDR
This rule detects suspicious command execution patterns on Linux systems involving scripting interpreters. Specifically, it looks for these interpreters being invoked with command-line arguments that suggest direct execution of code. This pattern is commonly associated with web shell activity, reverse shells, or other forms of arbitrary code execution.
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory. This is indicative of a Dead Drop Resolver (DDR) technique utilized by the Gamaredon group to retrieve Command and Control (C2) configuration data.
Detects the specific command line arguments used by Payouts King ransomware, specifically requiring the mandatory execution trigger parameter '-i' alongside at least one of the obfuscated behavior flags: '-noelevate', '-nohide', '-nopersist', or '-note'. This combination is highly indicative of Payouts King ransomware execution.
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
This rule detects when a web browser initiates the execution of an executable (.exe), dynamic link library (.dll), JavaScript (.js), or VBScript (.vbs) file. This behavior can be indicative of malicious activity such as drive-by downloads, phishing attacks leading to malware execution, or exploitation of browser vulnerabilities.
Detects the execution of the 'tee' command via sudo, potentially indicating local privilege escalation. This activity has been observed in VerdantBamboo campaigns exploiting a sudo misconfiguration for the 'egnyteservice' account on Egnyte Storage Sync systems.
Monitors the IIS worker process (w3wp.exe) for the execution of suspicious child processes such as cmd.exe, powershell.exe, and whoami.exe. This behavior is commonly associated with post-exploitation reconnaissance and execution via web shells, including those deployed during KnowledgeDeliver ViewState deserialization attacks.
Detects the specific sequence of commands used in the ClickFix FakeCaptcha attack, moving a ZIP from Downloads, extracting it via tar, and silently executing a batch file. This rule looks for `cmd.exe` processes that contain `move`, `Downloads`, `tar`, `start`, `-xf`, and `/min` in their command line, along with specific payload filenames like `update.zip`, `u.zip`, or `update.bat`.
Detects the execution of a malicious Java process spawned by the Metasploit Confluence plugin, which is often used for remote code execution (RCE) via Confluence vulnerabilities. The rule looks for java.exe spawned from the Confluence directory with specific command-line arguments containing a classpath pointing to the user's Temp folder with a ~spawn prefix and a Payload class.
Detects the execution of the 'MicrosoftSystem64' RAT binary across Windows, macOS, and Linux operating systems. This specific malware is associated with the FAMOUS CHOLLIMA threat group, which is linked to DPRK, and is known to deploy a Node.js SEA RAT that exfiltrates data to HuggingFace.
Page 110 of 155