Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
The following analytic detects the use of the EncodedCommand parameter in PowerShell processes. It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types. This activity is significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder. If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment. Review parallel events to determine legitimacy and tune based on known administrative scripts.
MCP Remote RCE Via Oauth
YARA-L
Detects potential remote code execution via a malicious OAuth URL in the mcp-remote proxy tool, indicative of CVE-2025-6514 exploitation.
Detects processes potentially related to XillenStealer making outbound network connections or DNS queries for telegram.org. This is indicative of command and control or data exfiltration activity.
This detection looks at users attempting to download files from the internet using powershell / cmd commands. It measures the number of commands against a baseline set over the past 14days and if a user has performed an unusual amount of commands (also more than 5) then an alert will be created. This will detect when an attacker has compromised a user and is now attempting to download payloads from the internet or a C2.
Detects the execution of command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe) from the Netlogon or Sysvol shares. This activity is highly suspicious as these shares are typically used for Group Policy and logon scripts, not for direct execution of interactive shells or scripting engines by users or processes. This could indicate an adversary attempting to execute malicious code or scripts from a central, often replicated, location within a Windows domain environment, potentially for lateral movement, persistence, or privilege escalation.
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
Detects the ITarian RMM service (RmmService.exe) spawning a child process from various suspicious directories commonly used for malware staging. This behavior is associated with adversaries using ITarian for post-exploitation activities, such as dropping additional malware.
This analytic detects suspicious Python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones. This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
Detects various activities associated with the AppSuite PDF Editor backdoor, a trojanized application with extensive backdoor capabilities. This rule looks for specific command-line execution, persistence mechanisms, and network communications.
This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. This behavior has been observed in attack campaigns such as DUCKTAIL, where browsers are automated to stealthily download content from the internet using direct URLs or suspicious hosting platforms. The detection focuses on identifying connections to known file-sharing domains or direct IPs extracted from command-line arguments and cross-checks those against the destination of the flow. Since it leverages Cisco Network Visibility Module telemetry, the rule triggers only if a network connection is made.
The analytic detects the use of Windows InstallUtil.exe with an HTTP or HTTPS URL in the command line. This activity is significant as it may indicate an attempt to download and execute malicious code, potentially bypassing application control mechanisms. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, or persistent access within the environment. Analysts should review the parent process, network connections, file modifications, and related processes for further investigation.
Detects potential exploitation of a critical ABAP code injection vulnerability (CVE-2025-42957) in SAP S/4HANA. An attacker with low-level privileges can leverage a vulnerable RFC module, /SLOAE/DEPLOY, to execute arbitrary code and gain full control of the system.
Detects potential misuse of AI model APIs by correlating process creation, network activity, and non-standard AI service ports.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Covers Ollama, OpenAI, Azure OpenAI, Anthropic, Google Gemini, Mistral, Cohere, Copilot, OpenRouter, Together, and Perplexity.
Detects activity related to the PromptLock ransomware, which leverages the Ollama AI API and is written in Go. This rule looks for network connections to the Ollama service (port 11434) and related process executions, specifically identifying processes like go.exe, curl.exe, wget.exe, python.exe, powershell.exe making connections or processes with 'ollama' in their command line.
This detection identifies suspicious child processes of SpeechRuntime.exe that could indicate abuse of a vulnerability. SpeechRuntime is vulnerable to an attack that allows a user to run code on another user's session remotely and stealthily by exploiting a Windows COM class. When this class is invoked, it launches SpeechRuntime.exe in the context of the currently logged-on user. Because this COM class is susceptible to COM Hijacking, an attacker can alter the registry remotely to point to a malicious DLL. By dropping that DLL on the target system (e.g., via SMB) and triggering the COM object, the attacker causes the malicious DLL to load into SpeechRuntime.exe and execute under the user's context. The rule specifically looks for SpeechRuntime.exe spawning common command and scripting interpreters or tools used for execution and file transfer.
No description available.
Detects the execution of the 'forfiles.exe' utility with the '/c' flag. This behavior, while legitimate, can be abused by adversaries to proxy execution of arbitrary commands or binaries, potentially bypassing application whitelisting controls. This technique is often associated with Living Off The Land Binaries (LOLBAS).
Detects a potentially suspicious one-liner command combining 'ping' and 'copy' within a 'cmd.exe' process. This combination is often used by malware for purposes such as network reconnaissance followed by data staging or exfiltration, or as a defense evasion technique by leveraging common system utilities in an unusual manner. The rule specifically looks for the presence of 'ping' and 'copy ' along with either the '-n' (count) or '-y' (yes to overwrite) flags in the command line.
This rule detects the use of PsExec or PAExec with command-line flags designed to escalate privileges to the LOCAL_SYSTEM account. Specifically, it looks for the '-s' flag, optionally combined with '-i', followed by common shell executables like 'cmd', 'powershell', or 'pwsh'. This behavior is indicative of an attempt to gain SYSTEM-level access on a Windows machine.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.
Page 128 of 155