Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects php/perl/ruby one-liner execution patterns combined with network or shell invocation primitives, consistent with trusted interpreter abuse and execution guardrail bypass.
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
This rule detects a suspicious attack chain, potentially related to 'ClickFix' or similar social engineering campaigns. It correlates multiple events within a 5-minute window: a browser being launched from an email client, a file download from a browser into the Downloads directory, and a command prompt being launched from explorer.exe executing a command that references the Downloads directory. Additionally, it looks for network connections initiated by common document types, which could indicate malicious document activity.
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
Detects execution of Impacket's MSSQL client tool, commonly used for lateral movement against Microsoft SQL servers using compromised credentials. Includes detection of proxychains usage and Python-based execution patterns.
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Detects usage of winget to add new additional download sources
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Detects usage of winget to add new potentially suspicious download sources
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
Detects PowerShell execution with suspicious Base64 decoding, commonly linked to malware installation
Detects when the macOS Script Editor utility spawns an unusual child process.
Hacktool Ruler
Sigma
This events that are generated when using the hacktool Ruler by Sensepost
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Page 115 of 155