Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects suspicious activity involving the Windows RunMRU registry key followed by a process launch. Specifically, it looks for modifications to the `RunMRU` registry key that contain certain suspicious strings (e.g., `nslookup`, `dig`, `powershell`, `cmd.exe`, `curl`, `wget`, `certutil`, `bitsadmin`, or various command-line obfuscation/download patterns). Subsequently, it correlates this registry modification with a process launch on the same host and by the same user, where the process command line also contains one of these suspicious strings. This behavior could indicate an adversary attempting to establish persistence or execute malicious commands.
This rule detects suspicious Python execution patterns that are commonly abused by attackers. It looks for Python interpreters executing commands inline, from user-writable paths (like AppData, Temp, Downloads), or using suspicious modules/functions (requests, socket, subprocess, base64, ctypes, urllib, exec, eval). Additionally, it identifies Python processes that include indicators of downloading or installing tools (pip install, wget, curl, powershell, bitsadmin). The rule filters out common development tools and system accounts to reduce false positives.
This rule detects attempts to download the 'clawd.bot' or 'openclaw.ai' installation scripts using various command-line tools. It specifically looks for the use of 'curl', 'wget', 'aria2c', 'fetch', 'powershell', 'pwsh', 'certutil', 'bitsadmin', or 'mshta' when their command lines contain either 'clawd.bot/install.sh' or 'openclaw.ai/install.sh'. This activity is indicative of potential malware deployment or initial access attempts related to the OpenClaw/Clawd threat.
This rule detects the execution of bash or sh scripts that contain specific keywords associated with the OpenClaw installation process. It looks for command lines that include "openclaw" along with other distinctive strings such as "run_remote_bash", "OPENCLAW_INSTALL_SH_NO_RUN", "OPENCLAW_USE_GUM", "All your chats, one OpenClaw", ".openclaw/openclaw.json", or "openclaw.ai/install.sh". This aims to identify potential OpenClaw installation attempts, even if the script itself has been renamed.
FileFix is a sophisticated social engineering attack, emerging in mid-2025, that abuses the Windows File Explorer address bar to execute malicious PowerShell commands. It is an evolution of the "ClickFix" technique, shifting from the Run dialog (Win+R) to the Explorer address bar (Ctrl+L).
Detects command injection related attacks with AI agents through suspicious prompt patterns or system command execution by AI processes.
This rule detects suspicious process creation events where `explorer.exe` (Windows Explorer) launches various scripting or utility executables (`powershell.exe`, `cmd.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, `installutil.exe`, `wmic.exe`, `certutil.exe`, `msdt.exe`). The detection is specifically triggered when the command line of the launched process contains indicators of network communication (e.g., `http://`, `https://`, `iwr`, `invoke-webrequest`, `curl`, `wget`, `bitsadmin`, `downloadstring`, `downloadfile`), encoded commands (`-e` or `-encodedcommand` with base64-like strings), or UNC paths (`\\`). It also specifically looks for `certutil` being used with `-urlcache`, `-decode`, or `-f` flags. The rule includes exclusions for common legitimate activities such as downloads from `chocolatey.org`, `nuget.org`, `aka.ms`, `cmd.exe` launching a browser to a URL, and `certutil -hashfile` operations.
Detects PowerShell downloading XWorm V6 binary from github.com, spawned by wscript.exe
This rule detects the execution of processes with command lines containing specific strings associated with the Diaoyu loader, a component of the Shadow Campaigns espionage activity. The rule looks for the presence of 'pic1.png', 'padeqav', 'admin-bar-sprite', or 'DiaoYu' within the command line arguments of newly created processes. This activity is linked to Unit 42 TGR-STA-1030.
Detects suspicious child processes spawned by sqlservr.exe, potentially associated with Trigona threat actor activity.
This rule detects suspicious commands being set in the RunMRU registry key by explorer.exe. It specifically looks for the presence of LOLBins such as powershell, mshta, and curl, as well as obfuscation techniques like caret (^) and ProxyCommand, or patterns indicative of encoded/script execution (e.g., Invoke-Expression, FromBase64String, -eC). This activity is associated with the 'ClickFix' social engineering technique.
This rule detects patterns associated with the Yellow Cockatoo RAT, specifically looking for process creation events where an interpreter is executed with command-line arguments containing both XOR encoding indicators and references to shortcut files ('.lnk') for potential persistence or execution.
This rule detects the execution of script hosts (PowerShell, wscript, cscript) that are launched by either the Windows Run dialog (rundll32, dllhost) or common web browsers (Chrome, Microsoft Edge, Firefox). The script host execution is further narrowed down by looking for command-line arguments indicative of script execution, such as encoded commands or invocation of functions like 'Invoke-' or 'IEX('. This pattern is often associated with the 'ClickFix' social engineering technique where users are tricked into pasting malicious commands into the Run dialog or clicking links that trigger script execution from a browser.
This rule detects the KongTuke second-stage PowerShell loader. It specifically looks for PowerShell scripts that attempt to read a payload from a file named 'Remove-NetNatStaticMapping.log', decrypt it using DPAPI (Data Protection API) via 'ProtectedData]::Unprotect' and 'DataProtectionScope]::Localmachine', and then execute the decrypted content using an 'iex' alias. The script also includes references to 'Add-Type -AssemblyName System.Security' and 'AppActions', indicating advanced PowerShell capabilities and potential interaction with application-related data. The use of 'ReadAllBytes' and 'UTF8.GetString' suggests the payload is read as raw bytes and then converted to a string for execution.
Detects Chromium-based browsers (e.g., Microsoft Edge, Google Chrome) being launched with specific command-line arguments that attempt to hide the browser window (headless mode or positioning it off-screen).
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
Detects instances where the Windows 11 Notepad process (Notepad.exe) spawns unexpected child processes. This behavior is a primary indicator of the CVE-2026-20841 exploitation via malicious Markdown links, which allows for remote code execution.
Detects XWorm V6 infection chain where wscript.exe spawns powershell.exe executing a .ps1 with Start-Process powershell
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects when a VM Run Command is executed successfully, followed by the VM's Managed Identity authenticating to Azure Resource Manager. This pattern may indicate an attacker using Run Command to steal MI tokens for lateral movement.
Detects suspicious process execution patterns indicative of the ClickFix / CrashFix Python RAT. This rule specifically looks for 'finger.exe' or 'powershell.exe' with encoded or obfuscated commands, especially when initiated by common browser processes or explorer.exe, which aligns with social engineering techniques involving malicious copy-pasting.
Detects a sequence of events associated with a malicious Notepad++ update. This malicious process executes reconnaissance commands.
Page 121 of 155