Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,465 detections
Filters
Last updated
All Time
Detection languages
1,884
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,670
2,392
1,718
312
Platforms
4,410
153
89
34
21
Products / Services
1,183
1,146
1,042
668
277
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
4,465
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects node.exe executing from non-standard, user-writable locations, a TTP associated with the Tsundere Bot malware used by TA584. This rule specifically looks for Node.js runtime execution initiated by common shell or script host processes from directories like AppData or Users\Public.
Detects Claude Code spawning suspicious child processes, consistent with abuse of project configuration hooks or MCP initialisation commands.
This rule detects activities associated with the XWorm LATAM campaign. It identifies network indicators such as specific C2 domains (jholycf100.ddns.com.br, voulerlivros.com.br, res.cloudinary.com), a specific IP address (152.249.17.145), and a destination port (7000). It also looks for the abuse of CasPol.exe making outbound connections to the identified C2 infrastructure. Furthermore, the rule detects PowerShell processes spawned by WMI (WmiPrvSE.exe) that attempt to fetch content from Cloudinary and load assemblies in memory, indicating potential in-memory execution. Finally, it includes a specific SHA256 file hash (7befeacf0b3480fb675d0cab7767b5b9697edc9d0e05982025a06ead0054afd5) associated with the campaign.
Detects a Java process starting cmd or PowerShell. On an ActiveMQ server this can indicate that someone is running commands after exploiting the service.
Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.
This rule detects PowerShell or pwsh.exe processes executing commands that contain specific lookalike domains and paths associated with a watering-hole attack targeting EmEditor users. The rule looks for command lines containing 'emeditorjp.com', 'emeditorgb.com/run/mg8heP0r', 'emeditorde.com/gate/start/2daef8cd', or 'cachingdrive.com/gate/init/2daef8cd'. This activity indicates a potential compromise where a modified installer or malicious script is attempting to fetch additional hidden code from these domains.
Detects the Claude CLI or Claude Code spawning suspicious child processes such as shells or network utilities. This behavior indicates exploitation of malicious hooks or MCP server configurations executing arbitrary commands, as seen in CVE-2025-59536 and CVE-2026-21852.
This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.
This rule detects activity associated with the DYNOWIPER malware. It identifies the malware through specific SHA256 file hashes, known filenames (dynacom_update.exe, source.exe, schtask.exe, dynacon_update.ps1, exp.ps1), and process names (dynacom_update.exe, source.exe, schtask.exe, powershell.exe). Additionally, it flags network connections to or from a set of known malicious IP addresses (185.200.177.10, 31.172.71.5, 193.200.17.163, 185.82.127.20, 72.62.35.76) which are associated with VPN logins or exfiltration reverse proxies used by DYNOWIPER.
Detects execution of a suspicious payload from common staging locations used in multi stage campaigns.
Detects a phishing delivered JScript stage that spawns a hidden PowerShell instance (often via WMI Win32_Process.Create)
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
Detects the execution of legitimate .NET framework utilities (Aspnet_compiler.exe, RegAsm.exe, vbc.exe) launched by scripting engines like PowerShell or WScript. This behavior is a known TTP for process hollowing, as seen in Agent Tesla campaigns, where malware injects its code into a trusted process to evade defenses.
Detects a low-noise XWorm execution chain described by ANY.RUN where WmiPrvSE.exe spawns PowerShell that uses WebClient to fetch Cloudinary-hosted content and performs in-memory Assembly.Load.
Detects Microsoft Office applications such as Word or Excel spawning a command-line interpreter (cmd.exe or powershell.exe). This behavior is often associated with malicious documents that execute macros to run commands on the victim's system. The MuddyWater group has been observed using this technique in their 'Operation Olalampo' campaign.
This rule detects the creation of suspicious child processes by Microsoft Office applications. This behavior is commonly associated with malicious macros embedded in Office documents or phishing attacks that leverage Office documents to execute arbitrary commands. The rule specifically looks for Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Publisher, Visio, Access) spawning known suspicious executables like command prompts, PowerShell, script interpreters (wscript, cscript), and various utility tools (mshta, regsvr32, rundll32, certutil, bitsadmin, wmic, schtasks, whoami, net, netsh, nslookup, curl).
Detects PowerShell executing a self-parsing command to extract a hidden payload from a batch file. This technique was observed in the Dead#Vax campaign. The malware reads its own batch file content to find a line starting with '@' which contains the next-stage encrypted payload.
This rule detects the creation of scheduled tasks (`schtasks.exe /create`) where the command line arguments contain suspicious executables or paths commonly associated with malicious activity. This indicates a potential persistence mechanism being established by an adversary.
Detects suspicious modification of AI assistant configuration files potentially related to MCP server injection.
Detects a Windows Script Host process (wscript.exe or cscript.exe) using WMI to spawn a PowerShell process. This technique is used by malware, such as in the Remcos RAT delivery chain, to break the parent-child process relationship and evade detections based on process ancestry.
Detects script engines using common download or decoding primitives that frequently appear in staged malware delivery.
Detects PowerShell executing curl.exe to download a batch script (.bat or .cmd), consistent with the Dohdoor multi stage chain described by Cisco Talos.
Page 149 of 213