Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,465 detections
Filters
Last updated
All Time
Detection languages
1,884
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,670
2,392
1,718
312
Platforms
4,410
153
89
34
21
Products / Services
1,183
1,146
1,042
668
277
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
4,465
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
The rule detects the processes that are executed by the Moonrise malware, which is a backdoor used by the APT29 group.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
Detects the execution of PowerShell with a command line containing a specific sequence of strings associated with extracting and executing malware from a ZIP file, as observed in the Steam_Monitor campaign. This typically involves using PowerShell commands like 'Get-ChildItem', '::OpenRead', and 'TaR' in conjunction with a '.zip' file.
Detects the use of PowerShell to disable or weaken Microsoft Defender security features. This technique is commonly used by malware to evade detection before executing malicious payloads, as seen in the referenced Fortinet report.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
Detects a PowerShell command pattern commonly used by the IClickFix framework. This involves using a hidden window to download a script (often .ps1 or .json) and execute it, bypassing the execution policy. This is a common technique following a "ClickFix" social engineering lure.
Detects Node.js package managers (npm, yarn, pnpm) spawning suspicious child processes like network utilities or shells during the installation of a package. This TTP is abused by malicious packages like 'ambar-src' which use 'preinstall' lifecycle scripts to download and execute secondary payloads.
Detects the Microsoft SharePoint worker process (w3wp.exe) spawning suspicious child processes often used for post-exploitation activity, such as command shells or scripting engines. This behavior is a strong indicator of a webshell execution, as seen in the ToolShell exploitation campaigns.
Detects instances where a LNK file execution is followed by the launch of a PowerShell process that contains command-line arguments for downloading and/or executing content from the internet. This behavior is the initial execution step in the attack chain detailed in the referenced Fortinet report.
Detects PowerShell commands using the call operator '&' with 'Get-Command' (gcm) or 'Get-Alias' (gal) containing wildcards to resolve and execute sensitive cmdlets. This is a common technique to evade static string-based detections for commands like 'Invoke-Expression' or 'Invoke-WebRequest'.
Detects the Apache ActiveMQ process (java.exe or wrapper.exe) spawning a command shell or web utility. This behavior is a strong indicator of post-exploitation activity following the exploitation of vulnerabilities like CVE-2023-46604, often used as an entry point for ransomware like LockBit 5.0.
Detects svchost.exe spawning a shell process (cmd.exe or powershell.exe) where its parent is not the legitimate services.exe. This behavior is a known technique used by Moonrise RAT to proxy commands and evade detection. The rule further scopes to commands targeting temp or public directories, which are common malware staging areas.
Detects PowerShell scripts that dynamically define and compile C# code to access Win32 APIs associated with process injection. This fileless technique is used by malware like Dead#Vax to inject shellcode (e.g., AsyncRAT) into the memory of legitimate processes, evading disk-based detection. The rule specifically looks for the use of `Add-Type` to compile C# code that imports functions from `kernel32.dll` and utilizes `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
Detects instances where a development environment like VS Code or Cursor spawns a shell process that then uses a download utility to fetch and execute remote content. This is a known TTP for the 'Contagious Interview' campaign which abuses IDE task auto-execution features.
This rule detects activity related to the EmEditor watering hole attack, specifically looking for PowerShell execution making requests to known malicious lookalike domains and network connections to the associated infrastructure. A match suggests a potential download of malicious code during what appeared to be a legitimate install or update. Investigation should focus on identifying the host, user, source of activity, and legitimacy of the install source, followed by evidence preservation, credential reset, and a search for follow-up malicious activity.
This rule detects suspicious activity related to WebView2 processes interacting with AI webchat domains, potentially indicating covert command and control (C2) proxying or other malicious use. It looks for WebView2 traffic to specific AI domains (Grok, Copilot) originating from unusual parent processes, WebView2 access to Grok with URL parameter-driven prompt execution, and suspicious child process execution (cmd.exe, powershell.exe, calc.exe) where WebView2 is the parent process.
Detects when the Windows Service Control Manager (services.exe) spawns a suspicious child process. This can indicate an attacker has configured a service's recovery options to execute a malicious command or script upon service failure.
Detects a pattern associated with the 'ClawHavoc' campaign where processes related to the OpenClaw AI framework download and immediately execute content from the internet. This is often seen in malicious 'prerequisite' or 'setup' scripts exploiting CVE-2026-25253.
This rule detects PowerShell commands used to encode data (like hostnames) into hexadecimal strings and exfiltrate it via DNS queries to known Out-of-Band Application Security Testing (OAST) domains. This technique is used by attackers to bypass egress filtering and confirm system compromise, as seen in the exploitation of CVE-2026-1731.
This detection is designed to help you find activity related to Triofox CVE-2025-12480 (Host header localhost). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
Detects PowerShell processes launched by Windows Explorer, which is characteristic of a user executing a command from the 'Run' dialog (Win+R). The detection targets command lines associated with the "ClickFix" social engineering technique, which tricks users into running malicious code. This includes looking for encoded commands or specific strings from the "reCAPTCHA Phish" toolkit.
This rule detects the execution of install scripts associated with 'OpenClaw' or 'Clawdbot' via various command-line interpreters. It specifically looks for commands involving 'curl', 'wget', 'bash', 'sh', 'zsh', 'pwsh', 'powershell', 'node', or 'npm' that contain specific URLs or package names related to the installation of these tools. This includes shell scripts like 'install.sh', 'install-cli.sh', PowerShell scripts like 'install.ps1', and npm installations like 'npm install -g openclaw'.
Page 148 of 213