Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects the execution of command-line interpreters (bash, powershell, cmd, python) that include commands for invoking expressions or downloading content (invoke-expression, curl, wget, Invoke-WebRequest) AND contain specific keywords associated with AI agents (moltbot, openclaw, clawdbot). This combination suggests an AI agent potentially executing arbitrary or malicious commands, possibly as a result of prompt injection or an unusual script execution scenario.
This rule detects the execution of known webshells such as Behinder, Neo-reGeorg, Godzilla, or reGeorg. The detection is specifically triggered when these webshells are found in the command line of a process whose parent process is a common web server application like w3wp.exe (IIS), httpd.exe (Apache), nginx.exe (Nginx), or java.exe (often used for Java-based web servers like Tomcat). This indicates potential webshell deployment and execution on a web server, which is a critical indicator of compromise, often associated with initial access or persistence by attackers.
This rule detects the execution of 'node' with 'install' and 'openclaw' in its command line, or any process command line containing 'https://openclaw.ai/install.'. This indicates an attempt to install or execute the 'openclaw' tool, potentially for malicious purposes or unauthorized software deployment.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detects the execution of 'finger.exe' or 'ct.exe' with command-line arguments indicating an attempt to start 'cmd.exe', correlated with network connections to a known malicious IP address (69.67.173.30). This behavior is indicative of LOLBIN (Living Off the Land Binaries and Scripts) abuse for command and control communication.
This detection identifies potential abuse of the Windows Package Manager (winget.exe) for malicious activities, including arbitrary command execution, execution from temporary directories, suspicious network egress, and installation of unsigned binaries from non-admin accounts.
This rule detects the execution of reconnaissance commands (whoami, tasklist, systeminfo, netstat) via `cmd.exe` where the parent process is either `GUP.exe` or `AutoUpdater.exe`. This behavior is indicative of the Notepad++ supply chain attack, where malicious updates could execute system reconnaissance commands. The detection specifically looks for output redirection, which is a common technique for adversaries to save command output.
Detects creation of malicious Lua script files in AppData\Roaming\Adobe\Scripts directory used in infection chain.
Detects suspicious PowerShell execution initiated by explorer.exe, specifically when the command line includes a .lnk file, execution policy bypass, and contains keywords or paths commonly associated with malicious activity (e.g., tor, ssh, github.io, dropbox.com, or suspicious temporary/public directories). This pattern is often observed in initial access or execution phases of attacks.
This rule detects suspicious process creation patterns where a Java or Tomcat process (common in Ivanti EPMM) spawns a command shell (cmd.exe, bash, sh) or a process containing 'sliver' or 'implant' in its command line. This behavior is indicative of potential Remote Code Execution (RCE) abuse, particularly in the context of Ivanti EPMM vulnerabilities.
This rule set detects potential post-exploitation activity and exploitation attempts targeting Ivanti EPMM (formerly MobileIron Core). The first rule, `ivanti_epmm_java_spawns_shell`, identifies suspicious process creation where a Java or Tomcat process (parent process) spawns a shell process (cmd.exe, bash, sh, or powershell.exe). This behavior is indicative of an attacker gaining remote code execution and using the compromised Java/Tomcat process to execute system commands. The second rule, `ivanti_epmm_http_featureusage_exploit`, detects HTTP requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of Expression Language (EL) injection or format string abuse, specifically looking for `format=` along with keywords like `${`, `Runtime`, `exec`, or `getRuntime` in the URL. This suggests an attempt to exploit a vulnerability in the Ivanti EPMM application to achieve remote code execution.
This rule detects suspicious activity related to Notepad++ updater (gup.exe or update.exe) executing reconnaissance commands or loading suspicious DLLs. Specifically, it looks for the updater process initiating common reconnaissance tools like cmd.exe, powershell.exe, or curl.exe with commands such as 'whoami', 'tasklist', 'systeminfo', 'netstat', 'ipconfig', or 'curl' that include redirection for staging. Additionally, it correlates this activity with the loading of suspicious DLLs (e.g., log.dll) from unusual locations like AppData or Temp folders, potentially indicating DLL sideloading.
Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.
Detects PowerShell download cradles that use commands like Invoke-RestMethod, Invoke-WebRequest, iwr, irm, curl, wget, Net.WebClient, DownloadString, DownloadData, or Start-BitsTransfer to download content, immediately followed by execution via Invoke-Expression or IEX. This technique is often used for fileless malware execution.
Detects the 'codesign' utility being used to extract code-signing requirements from trusted macOS system binaries. This is a key step used by malware to forge TCC permissions and inherit the privileges of trusted applications. The rule specifically looks for 'codesign' execution with '-d' and '--requirements' flags targeting common trusted binaries, initiated by scripting interpreters.
This rule detects the presence or execution of known malicious file hashes associated with the ClawdBot campaign. It monitors file creation/modification events, process creation events, and module/image load events across devices for specific SHA256 hashes. The identified hashes correspond to components like 'Code.exe', 'zoomupdate.msi', 'DWrite.dll', 'extension.js', and 'run.bat', which are known to be part of the ClawdBot malware.
This detection identifies common web attack patterns including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI) by inspecting URL and POST data for specific malicious patterns. It looks for indicators such as script tags, onerror/onload attributes, javascript: URIs, alert() functions for XSS; SQL keywords like UNION SELECT, xp_cmdshell, sp_configure, and common SQLi bypass patterns for SQLi; and directory traversal sequences (../../, ..%2f..%2f), and sensitive file paths like /etc/passwd, /windows/win.ini, php://filter for LFI.
Detects the creation or modification of a `.vscode/tasks.json` file that is configured to automatically run a task when a folder is opened.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
Detects Windows VBScript (wscript.exe or cscript.exe) processes establishing network connections to AI/LLM API endpoints. This behavior is highly anomalous as VBScript is typically used for local automation and rarely makes HTTPS API calls to external services. This pattern is consistent with PROMPTFLUX malware and jailbroken LLM variants like WormGPT. PROMPTFLUX uses Gemini's API to dynamically rewrite and obfuscate its own VBScript code at runtime. WormGPT variants use jailbroken Grok (xAI) or Mixtral (Mistral AI) APIs with manipulated system prompts to bypass guardrails. The malware queries AI models to generate new obfuscated versions of itself, creating a "just-in-time" metamorphic capability that constantly evolves to bypass static signature-based detection. Sysmon Event ID 3 is the best way to detect this behavior on endpoints.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) spawning suspicious child processes like command shells or script interpreters. This behavior can be indicative of malicious macro execution or exploitation of vulnerabilities, where an embedded OLE object leads to code execution.
Page 122 of 155