Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects a behavioral sequence where an AI agent runtime (e.g., Node.js, Python) spawns a shell to execute a web request utility like curl or wget. This pattern is a strong indicator of automated data exfiltration, often resulting from a successful prompt injection attack that instructs the agent to steal and send data to an attacker-controlled server.
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Detects when a suspicious process (such as a script interpreter or LOLBIN) is executed from a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious executables or scripts in these locations to bypass security controls and execute them, often as a result of a user opening a malicious document.
Detects exploitation attempts of CVE-2025-42944, a critical insecure deserialization vulnerability in SAP NetWeaver AS Java RMI-P4 module. This rule identifies when SAP Java processes spawn system shells or execute suspicious commands, which is indicative of successful exploitation of the deserialization flaw. Attackers can exploit this vulnerability by sending malicious serialized Java objects to exposed RMI-P4 ports (typically 50004 or 50014), leading to arbitrary OS command execution with full system privileges. This pattern detects the post-exploitation behavior where the compromised Java process spawns interactive shells, creates scheduled tasks, or executes system commands.
This rule detects the execution of specific child processes (write.exe, cmd.exe) when initiated by a predefined list of parent processes (Sang.exe, googleupdate.exe, vlc.exe, clreg.exe, Nlasvr.exe, qutppy.exe) and when the parent process command line contains certain keywords ('install', 'work', 'passuac'). This pattern can indicate suspicious activity, potentially related to malware installation, persistence, or command and control.
Detects the creation of scheduled tasks using 'schtasks /create' that include suspicious command-line arguments often associated with malicious activity, such as PowerShell execution, web requests (Invoke-WebRequest, curl, wget, bitsadmin), or script execution (.ps1, .vbs, .js). This rule aims to identify persistence mechanisms or initial access attempts.
Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.
This rule detects attempts to establish persistence by modifying the 'RunMRU' registry key to execute malicious commands. It specifically looks for the presence of common scripting and download utilities (powershell, pwsh, mshta, certutil, bitsadmin, curl, wget) combined with indicators of remote execution or code download (http, iex, Invoke-Expression, DownloadString, iwr, Invoke-WebRequest) within the registry data.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
This rule detects suspicious process creation patterns indicative of the MuddyWater (also known as RustyWater) APT group. Specifically, it looks for Microsoft Office applications (Word, Excel, PowerPoint) launching scripting or Living Off The Land Binaries (LOLBins) such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, wscript.exe, or cscript.exe. The detection is further narrowed down by checking if these processes are created in suspicious writable paths like ProgramData, Users\Public, AppData\Roaming, or AppData\Local\Temp. Additionally, the rule includes optional enrichment for known MuddyWater/RustyWater payload names (reddit.exe, art.exe, cloud.exe, nginx.exe), persistence via the Run registry key, and the dropping of a specific staging artifact named 'CertificationKit.ini'.
Detects execution of BADAUDIO malware downloader used by APT24
Detects the Microsoft Equation Editor (EQNEDT32.EXE) spawning a shell process. This behavior is highly anomalous and is a strong indicator of exploitation of vulnerabilities like CVE-2017-11882, as seen in a Remcos RAT campaign.
Detects a multi-stage process execution chain characteristic of the 'ClickFix' technique. This involves 'explorer.exe' spawning a headless 'conhost.exe', which subsequently executes a Living Off the Land Binary (LOLBin) such as 'curl', 'pwsh', 'powershell', or 'mshta' to download a payload from an HTTP/HTTPS source. This chain indicates an attempt to bypass traditional security controls and execute malicious code.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
Detects command interpreters (cmd.exe, powershell.exe) launching fodhelper.exe, an indicator of an UAC bypass attempt.
Detects PowerShell download cradles using Invoke-RestMethod or Invoke-WebRequest piped to Invoke-Expression for fileless malware execution.
Detects processes with document file extensions spawning command shells (cmd.exe or powershell.exe), indicating malware execution
This rule detects suspicious batch (.bat) file creation events by monitoring for several indicators. It flags batch files created by processes using command lines indicative of downloads (e.g., 'http:', 'https:', 'iwr', 'iex', 'invoke'), batch files created by suspicious executables ('curl.exe', 'mshta.exe'), batch files placed in high-risk directories ('\Users\Public\', '\Start Menu\Programs\Startup\'), or batch files exceeding a size threshold of 5MB. The rule explicitly excludes processes named 'java.exe' or 'javaw.exe' from triggering alerts.
Detects an attempt to disable .NET deserialization safeguards by modifying the 'disableActivitySurrogateSelectorTypeCheck' field. This technique was observed in an APT36 campaign where it was used to prepare the environment for the in-memory execution of a malicious DLL via unsafe deserialization.
Detects a host initiating network connections to multiple unique domains within a short time frame using common tools and interpreters.
This can be indicative of C2 channel rotation, or network enumeration.
This rule is excluding certain cloud metadata services.
This rule requires a correlation engine to aggregate events over time.
This can be indicative of C2 channel rotation, or network enumeration.
This rule is excluding certain cloud metadata services.
This rule requires a correlation engine to aggregate events over time.
Detects when a WebKit-based browser process on macOS spawns a shell or script interpreter. This is highly suspicious and can indicate successful exploitation of a browser vulnerability for initial code execution.
Page 123 of 155