Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This technique is used by the SStar Agent RAT for its remote 'type' functionality.
Detects PowerShell utilizing Invoke-WebRequest (iwr) to download a payload and subsequently executing it via Start-Process using rundll32 with the specific 'Begin' export function. This execution pattern is the primary secondary stage for the recent Ghost CMS ClickFix campaigns delivering information stealers.
Detects multiple attempts at command injection through IIS web server URI queries. The rule looks for common command execution functions like 'eval(', 'system(', or 'exec(' within the 'csUriQuery' field of W3C IIS logs. A threshold of 3 or more attempts from the same IP within an hour triggers the alert.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
This rule detects repeated execution of commands containing both 'version' and 'control' keywords within the command line. It specifically looks for at least 5 such executions within a one-hour window on the same computer by the same account. This pattern could indicate an adversary attempting to enumerate system or software versions, or interact with version control systems, potentially as part of reconnaissance or privilege escalation.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
Identifies npm or node executing lifecycle scripts (e.g., preinstall) for known malicious typosquatted packages. This campaign utilizes these hooks to silently execute a stage-2 credential harvester targeting cloud environments.
Detects the execution of mshta.exe fetching a .7z payload from a remote URL, as observed in ClickFix campaigns delivering AnimateClipper.
Identifies instances where a Jupyter Notebook is opened and initiates suspicious child shell processes. This may indicate the execution of embedded malicious HTML or scripts attempting to automate UI interactions, such as bypassing extension installation prompts in VS Code environments.
This rule detects various activities associated with the Nimbus Manticore implant, including its process execution with a specific argument, the creation of a scheduled task for persistence, and the staging of malicious files in a specific AppData directory. It looks for the execution of 'setup.exe' with 'doit' argument, the creation of a scheduled task containing 'BackupCheck', and the creation of specific files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' folder.
This rule detects attempts to access the AWS EC2 Instance Metadata Service (IMDS) by looking for HTTP requests containing the IP address '169.254.169.254' in the URI. This IP address is a well-known link-local address used by AWS instances to retrieve metadata. Such access attempts, especially when originating from an unexpected source or in an unusual context, can indicate a Server-Side Request Forgery (SSRF) vulnerability being exploited.
This rule detects attempts at Server-Side Template Injection (SSTI) by looking for specific patterns in HTTP URI requests. It triggers an alert if the URI contains sequences like `{{.*}}` or `${.*}`, which are commonly used in various template engines to inject and execute code.
This rule detects attempts to execute setuid binaries via a web shell by looking for the string "chmod+s" in HTTP URI requests. This indicates an attacker trying to set the SUID bit on a file, which is a common technique for privilege escalation on Linux/Unix systems.
Detects suspicious execution of the 'open' command targeting the Sparkle framework's installation cache directory on macOS. This activity could indicate the use of a backdoor like FlutterShell attempting to silently update or execute malicious code via a legitimate update mechanism.
This rule detects the use of specific command-line flags in Google Chrome processes that are associated with the FlutterShell backdoor. These flags, '--hide-crash-restore-bubble' and '--disable-session-crashed-bubble', are used by FlutterShell to suppress crash warnings after forcing a restart, indicating an attempt to evade detection or maintain persistence.
This rule detects an unusual number of process creations (Event ID 4688) containing both 'security' and 'patch' in their command line within a one-hour window on a single computer. This could indicate automated patching activity, but a high volume might also suggest suspicious system modifications or an attempt to disguise malicious activity as legitimate patching.
This rule detects suspicious activity related to OpenSSL or certificate manipulation by identifying processes that execute commands containing 'openssl' or 'certificate' keywords. It aggregates these activities by computer and account within one-hour bins and flags if three or more such activities occur, which could indicate credential access attempts or system misconfiguration.
This rule detects the creation of new processes where the command line contains keywords such as 'exploit' or 'vulnerability'. This could indicate an attempt to execute an exploit or leverage a known vulnerability, potentially as part of an attack.
This rule detects the execution of processes where the command line contains keywords commonly associated with malware, specifically 'backdoor', 'rootkit', or 'trojan'. It monitors Windows Security Event ID 4688 (a process creation event) and flags any command lines containing these terms.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
Page 111 of 155