Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This query identifies single character file names used at point of execution or in command line arguments with optional logic to look for the file creations.
This query retrieves the most recent record for each device and filters the results to show devices that are currently isolated.
• The DeviceInfo table contains details about each device and its status over time.
• The summarize arg_max(Timestamp, *) by DeviceName part selects the latest entry (based on Timestamp) for every device.
• The where MitigationStatus contains "Isolated" filter ensures that only devices with an isolation-related mitigation status are displayed.
• The DeviceInfo table contains details about each device and its status over time.
• The summarize arg_max(Timestamp, *) by DeviceName part selects the latest entry (based on Timestamp) for every device.
• The where MitigationStatus contains "Isolated" filter ensures that only devices with an isolation-related mitigation status are displayed.
A composite detection rule that identifies multiple techniques, tactics, and procedures (TTPs) associated with the RansomHub intrusion detailed in "The DFIR Report". This rule focuses on process creation events and flags the execution of specific credential dumping tools, network scanners, defense evasion commands, ransomware behaviors, and exfiltration tool chains. An alert from this rule indicates a high probability of malicious activity consistent with this threat actor's methodology.
This query detects execution of processes related to Visual Studio Code extension signing or caching that involve known Glassworm-compromised extensions. Based on indicators published by KOI (October 20, 2025), it identifies suspicious .vsix package operations potentially associated with self-propagating malicious VSCode extensions observed in OpenVSX and Microsoft VSCode marketplaces.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects suspicious behavior where a Node.js-based application launches cmd.exe to query MachineGuid from the registry, indicating potential fingerprinting or persistence activity by EvilAi malware. The rule specifically looks for processes initiated from a suspicious folder path, where node.exe is the parent process, and cmd.exe is used to query 'HKLM\Software\Microsoft\Cryptography' for 'MachineGuid'.
Detects the LANDFALL Android spyware components, specifically the 'b.so' loader and the 'l.so' SELinux policy manipulator.
This rule detects the execution of command-line interpreters (cmd.exe or powershell.exe) by either the w3wp.exe process (IIS worker process) or the wsusservice.exe process (Windows Server Update Services). This behavior can indicate a compromise, potentially leveraging vulnerabilities in web applications or WSUS to achieve remote code execution.
Detect the patten execution of the the brazilian malware Zapgrande
Detects when the Windows Server Update Services (WSUS) process (wsusservice.exe) or its associated IIS worker process (w3wp.exe with 'wsuspool' in its command line) spawns cmd.exe or powershell.exe. This activity is highly suspicious as WSUS services typically do not need to execute command-line interpreters, and could indicate an attempt to exploit a vulnerability or execute arbitrary commands on the system.
This rule detects the creation of common Windows command-line interpreters and utilities (cmd.exe, powershell.exe, pwsh.exe, powershell_ise.exe, whoami.exe, net.exe, net1.exe) when initiated by 'w3wp.exe'. The 'w3wp.exe' process is the IIS worker process, and the execution of these utilities from an IIS worker process can be indicative of web shell activity, compromise of the web server, or other malicious activity.
Detects the execution of a script file (e.g., VBS, JS, BAT, PS1) from a removable drive using a common script interpreter. This technique is used by the threat actor Tangerine Turkey for initial access.
This rule detects a sequence of events indicative of a potential macOS ClickFix attack. It looks for a base64 encoded command executed by 'bash' or 'zsh', immediately followed (within 10 seconds) by a 'curl' command that initiates a network connection to a URL. The rule specifically excludes a whitelisted curl command to reduce false positives. The correlation of base64 execution, a subsequent curl command, and a successful network connection to the domain extracted from the curl command suggests an attempt to download and execute malicious content, possibly after decoding it.
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Detects suspicious process execution patterns originating from AsperaFaspex, specifically targeting activities observed in campaigns attributed to Mint Sandstorm. The rule looks for PowerShell execution with suspicious command-line arguments (e.g., for credential dumping, defense evasion, or discovery), execution of tools like wget or curl for downloading content, attempts to modify local administrator groups, registry modifications for defense evasion, and WMI/vssadmin/wbadmin commands for persistence or defense evasion. This behavior indicates potential post-exploitation activity.
Detects suspicious process execution originating from ManageEngine applications, as observed in attacks attributed to Mint Sandstorm. The rule specifically looks for PowerShell, `lsass` related commands, `wget`, `curl`, script execution, local group modifications, network user additions, registry modifications for Defender or LSA, WMIC for process creation or shadow copy deletion, `vssadmin` for shadow deletion, and `wbadmin` for catalog deletion, all originating from a ManageEngine parent process. It filters out legitimate ManageEngine downloads.
This rule detects the installation of AppX or MSIX packages, specifically looking for installations initiated by PowerShell that are either developer-signed (EventID 855) or unsigned (EventID 603 with specific flags). It filters out known legitimate Microsoft packages to reduce false positives. The rule correlates PowerShell process events with device events related to AppX/MSIX installations within a 30-seconds window.
Detects potential FileFix attacks where a web browser spawns a suspicious child process (e.g., command prompt, PowerShell, MSHTA) via the file upload dialog's address bar.
Enhancement:
This query correlates two queries to find cases where a user accessed RunMRU and then executed a suspicious PowerShell command.
RMU flags are added to get more close records mapped with Registry Access to RunMRU (Clipboard Paste via Run Dialog) Copy Clipboard data.
Enhancement:
This query correlates two queries to find cases where a user accessed RunMRU and then executed a suspicious PowerShell command.
RMU flags are added to get more close records mapped with Registry Access to RunMRU (Clipboard Paste via Run Dialog) Copy Clipboard data.
This rule detects suspicious activity related to Windows Server Update Services (WSUS) that could indicate compromise. It correlates three types of events: 1) external network connections to WSUS ports, 2) modifications to the WSUS log file (SoftwareDistribution.log), and 3) suspicious processes (like cmd.exe, powershell.exe, whoami.exe, net.exe) spawned by WSUS-related processes (w3wp.exe, wsusservice.exe) with specific command-line arguments. The rule aims to identify scenarios where an attacker might be interacting with or manipulating a WSUS server.
Detects the installation of the Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Detects suspicious activity related to the Windows Subsystem for Linux (WSL), such as installing new distributions (especially penetration testing ones like Kali), importing custom images, or executing commands non-interactively. Attackers may use WSL to run malicious Linux binaries, hide artifacts, and evade defenses.
Page 125 of 155