Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
This rule detects PowerShell processes that are initiated by a LOLBAS binary and subsequently establish an outbound network connection to a public IP address. It leverages an external LOLBAS JSON data source to identify suspicious parent processes. This behavior could indicate an adversary using a Living Off The Land Binary or Script (LOLBAS) to execute PowerShell for malicious purposes, such as command and control or data exfiltration.
KQL Query from file: Clickfix Win + R Detection
Detects the creation of suspicious child processes (e.g., shells, network tools) by a Node.js or Next.js server process. This could indicate successful remote code execution, potentially related to vulnerabilities like React2Shell (CVE-2025-55182).
Detects the spawning of a shell process from a Node.js or Next.js server process, which is a strong indicator of post-exploitation activity following a Remote Code Execution (RCE) vulnerability like CVE-2025-55182 or CVE-2025-66478.
Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.
ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS
Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding
service endpoint and remotely execute code from the ArcSOC.exe process.
ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS
Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding
service endpoint and remotely execute code from the ArcSOC.exe process.
This rule detects instances where 'regedit.exe' is launched by a parent process that is not commonly associated with its execution. It specifically filters out common legitimate parent processes like 'explorer.exe', 'msiexec.exe', and 'cmd.exe', and also excludes parent processes originating from standard Windows and Program Files directories. This helps to identify suspicious or unauthorized attempts to modify the Windows Registry.
Detects Windows Script Host (wscript.exe or cscript.exe) execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges, APIPA, and local loopback. Threat actors frequently use raw or hex IP literals to bypass domain-based filtering and deliver payloads via script-based loaders.
Detects PowerShell command lines that reference HTTP/HTTPS content together with environment-backed AppData or Temp paths (e.g. %APPDATA%, $env:APPDATA, %TEMP%, $env:TEMP), a common pattern for downloading or staging payloads in user-writable directories.
Detects PowerShell command lines that use repeated, obfuscated string concatenation patterns such as "<str>"+"<str>" "<str>"+"<str>" (or the same with single quotes), which often appear in lightly obfuscated malware or LOLBins.
Often seen in dropper activity related to Clickfix.
Often seen in dropper activity related to Clickfix.
Detects cmd.exe execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges. Threat actors commonly use raw or hex IP literals to avoid domain filtering and deliver staged payloads.
Detects process execution patterns associated with the "Sha1-Hulud: The Second Coming" NPM supply chain attack. This includes the silent installation of the 'bun' runtime during an 'npm install' and a destructive file shredding command. The rule filters out legitimate manual installations by developers by checking the initiating parent process.
Detects suspicious behavior where a Node.js-based application, potentially EvilAi malware, launches cmd.exe to query MachineGuid from the registry or system model via PowerShell. This activity indicates potential fingerprinting or persistence activity, often originating from the \AppData\Local\Programs\ directory with medium integrity.
Detects the execution of a malicious JAR file, a technique used by the Bloody Wolf APT group to download and execute NetSupport RAT components.
Detects Go runtime executing scripts from temporary directories, indicative of FlexibleFerret backdoor.
Detects creation of .host file in temp directories by FlexibleFerret malware for identifying machines on macOS systems.
Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.
Detects when Visual Studio Code or its extension host spawns PowerShell, CMD, or similar interpreters (possible SleepyDuck payload execution).
This query focuses on detecting the Brazilian banking trojan known as Maverick. This malware has recently gained attention due to its aggressive propagation methods, particularly through WhatsApp Web. By leveraging social engineering techniques, Maverick spreads malicious links and attachments disguised as legitimate messages, tricking users into executing harmful code. Once installed, the trojan is capable of intercepting banking credentials, manipulating transactions, and exfiltrating sensitive financial information. Detecting Maverick requires monitoring suspicious script executions, abnormal network traffic patterns, and unauthorized use of processes such as cscript.exe and wscript.exe, which are often abused by attackers to run malicious payloads. The query aims to identify indicators of compromise associated with Maverick’s activity, helping security teams mitigate its impact and protect users from financial fraud
This rule detects the execution of unsigned or invalidly signed executable files from user-writable folders such as \Users\ or \ProgramData\. It specifically looks for process creation events where the initiating process's signature status is not 'Valid' and the SHA256 hash of the executable is not in a predefined whitelist. Additionally, it filters for executables with a global prevalence of less than 2500 and an unsigned signature state. This aims to identify potentially malicious or unauthorized software being run from locations where users typically have write permissions, bypassing standard software deployment and security controls.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns 'node.exe' with command-line arguments containing '-e' and the process path is located within the 'AppData\Roaming' or 'AppData\Local' directories. This behavior can be indicative of malicious activity, such as the execution of Node.js-based scripts or malware by PowerShell, potentially for persistence or further execution within user-specific application data folders.
Page 124 of 155