Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
Detects curl or wget commands fetching scripts from vercel.app or URL shorteners and piping to shell execution, consistent with Contagious Interview initial access.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
detects BPFDoor .lock and .pid files access in temporary file storage facility
This rule detects suspicious command-line activity indicative of SSH tunneling, external IP checks, and reconnaissance commands. It looks for specific IP addresses associated with known C2 or SSH tunnel infrastructure, SSH command-line options like 'StrictHostKeyChecking=no' and reverse tunnel flags ('-R', '-N'), the use of 'ifconfig.me' for external IP discovery, and various 'whoami' and 'groups' commands for system reconnaissance. It also flags activity related to 'FMAPP.exe' or 'FMAPP.dll'.
Detects execution of Warcode Crystal-based shellcode loader from common writable public directories used by APT36
Detects suspicious command interpreters and LOLBins written into the Explorer RunMRU registry key (commonly used for Run dialog history), with explorer.exe as the initiating process.
This rule detects PowerShell processes (powershell.exe, pwsh.exe, mbs.exe) that are executing commands to read the content of batch (.bat) or command (.cmd) files. This behavior has been observed in campaigns like Dead#Vax for self-parsing and in-memory payload extraction. The detection specifically looks for `Get-Content` or its alias `gc` within the PowerShell command line, targeting files with `.cmd` or `.bat` extensions.
This rule detects the creation of PowerShell aliases for high-risk cmdlets or .NET web client patterns. Adversaries may use 'Set-Alias' to create short, obfuscated aliases for common cmdlets like Invoke-WebRequest, Invoke-Expression, or cmdlets related to Defender tampering, making their command-line activity harder to detect and analyze. This detection focuses on the 'ProcessCreated' event for PowerShell processes where 'Set-Alias' is used to map to a predefined list of suspicious cmdlets or patterns.
This rule detects network connections initiated by specific executables (clawdbot, node, moltbot, openclaw) from a local port (18789, 3000, or 8080) to a remote IP address that is not localhost, not within private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), and not within the 17.0.0.0/8 CIDR block. This could indicate command and control (C2) communication or unauthorized data exfiltration by potentially malicious bots or applications.
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
This rule detects suspicious PowerShell activity that involves hidden windows, execution policy bypass, and attempts to download or execute files. It specifically looks for PowerShell processes launched by common parent processes like explorer.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, or rundll32.exe, combined with command-line arguments indicative of stealthy execution and payload delivery. The rule identifies two main scenarios: 'Hidden Downloader and Execution' where PowerShell is used with hidden window styles and download commands, and 'Inline Launcher and Payload Delivery' where PowerShell is used with no profile and download/execution commands.
Detects attempts to perform Indirect Prompt Injection (IDPI) by embedding malicious instructions for AI agents or Large Language Models (LLMs) within web content. This rule identifies when common prompt injection keywords are present in conjunction with CSS techniques used to hide the text from being rendered in a browser, a method used to evade human review while targeting automated systems.
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google WinRAR CVE-2025-8088 Exploitation. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: WinRAR launching a command shell or scripting engine. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar- vulnerability) to document where the indicator came from and to support incident notes and reporting.
Detects the Apache ActiveMQ process (java.exe or wrapper.exe) spawning a command shell or web utility. This behavior is a strong indicator of post-exploitation activity following the exploitation of vulnerabilities like CVE-2023-46604, often used as an entry point for ransomware like LockBit 5.0.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google WinRAR CVE-2025-8088 Exploitation. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: WinRAR launching a command shell or scripting engine. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar- vulnerability) to document where the indicator came from and to support incident notes and reporting.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
This rule detects activity related to the EmEditor watering hole attack, specifically looking for PowerShell execution making requests to known malicious lookalike domains and network connections to the associated infrastructure. A match suggests a potential download of malicious code during what appeared to be a legitimate install or update. Investigation should focus on identifying the host, user, source of activity, and legitimacy of the install source, followed by evidence preservation, credential reset, and a search for follow-up malicious activity.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
Detects suspicious Claude Code configuration keys linked to automatic hook execution or automatic MCP server enabling, which were used to bypass consent and execute commands.
Page 119 of 155