Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the execution of a Word document via the WinWord Start Menu shortcut using `cmd.exe`. This behavior has been observed in KamiKakaBot samples to initiate the second stage of infection. The rule specifically looks for `cmd.exe` executing a command line that includes a `.lnk` file, a path containing `Start Menu\Programs\Word`, and a `.doc` file extension.
Detects the execution of `cmd.exe` with output redirection (`>`) to suspicious locations such as temporary directories, user profile directories, or `ProgramData`. This technique is often used by adversaries to save the output of reconnaissance commands (e.g., `hostname`, `dir`) to files for later exfiltration, helping them evade immediate detection by storing command output in less scrutinized locations.
Detects the execution of a renamed "NirCmd.exe" binary based on its original filename metadata. This rule specifically looks for instances where the 'OriginalFileName' field in the process creation event is 'NirCmd.exe', but the actual executed image path does not end with 'nircmd.exe' or 'nircmdc.exe'. This indicates an attempt to evade detection by renaming the legitimate NirCmd utility.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.
Detects the execution of specific processes and command line combinations associated with the Forest Blizzard APT group. This includes the creation and deletion of scheduled tasks using 'schtasks.exe' and PowerShell commands for file operations, as described by Microsoft.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server, where an attacker can exploit vulnerable endpoints to create admin accounts and execute arbitrary commands. Specifically, this rule looks for suspicious child processes like cmd.exe or powershell.exe being spawned by Tomcat processes associated with Confluence.
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the execution of a shell as a sub-process of "rsync" without the expected command line flag "-e" being used. This behavior is commonly associated with attempts to exploit CVE-2024-12084, leading to arbitrary command execution or privilege escalation.
Detects the creation of a file named "wermgr.exe" in an uncommon directory, which could indicate exploitation of CVE-2023-36874. The rule specifically looks for 'wermgr.exe' being created outside of standard Windows system directories, aiming to catch malicious instances masquerading as the legitimate Windows Error Reporting Manager.
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Detects remote binary or command execution via the ScreenConnect Service. This rule is intended for hunting anomalous executions originating from ScreenConnect, which is a legitimate remote administration tool that can be abused by threat actors.
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects process creation activity related to the Peach Sandstorm APT, specifically looking for a unique string 'QP's\*(58vaP!tF4' in the command line. This string is likely a unique identifier or a specific parameter used by the APT's tools.
This rule detects the execution of the PingCastle utility, a legitimate Active Directory security assessment tool, when its executable name has been changed. Adversaries often rename legitimate tools to evade detection. The detection logic relies on identifying specific original file names within the PE metadata (OriginalFileName) and/or recognizing characteristic command-line arguments used by PingCastle, such as those related to scanner functions or health checks. The rule specifically filters out executions where the image path matches the original PingCastle executable names, focusing on instances where the binary has been renamed.
Detects suspicious usage of the ShellExec_RunDLL function to launch other commands, as observed in the Raspberry Robin attack. This rule specifically looks for 'ShellExec_RunDLL' in the command line combined with suspicious paths or commands like 'Desktop', 'Temp', 'Users\Public', 'comspec', 'iex', 'Invoke-', 'msiexec', 'odbcconf', or 'regsvr32'.
Detects the execution of Stracciatella, a hack tool that executes PowerShell runspaces from within C# (SharpPick technique) while attempting to disable AMSI, ETW, and Script Block Logging. Detection is based on the executable's name, original filename, description, or specific SHA256 hashes.
Detects a Python process attempting to spawn a pseudo-terminal (TTY) using the `pty` module. This behavior is often indicative of an attacker establishing a reverse shell for interactive command execution on a compromised system. The rule specifically looks for Python executables and command-line arguments that import the `pty` module and call its `spawn` function.
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the "RunMRU" registry key. This technique has been observed in campaigns where threat actors trick users into pasting and executing malicious commands, often under the guise of CAPTCHA verification steps, to deliver malware like Lumma Stealer.
Detects the use of rar.exe to create an archive with a password and recursive flag, specifically targeting system folders or common staging directories. This behavior is often associated with attackers collecting and preparing data for exfiltration.
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
Page 147 of 155