Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects the execution of PowerShell with hidden window style attempting to download Node.js related files (e.g., .msi or node.exe) from nodejs.org using common download cmdlets or utilities.
Detects the execution of PowerShell with a bypass execution policy that performs a download or web request to save content to a file in the user's temp directory, followed by the immediate execution of that file. This pattern is characteristic of multi-stage malware droppers or fileless attack techniques attempting to stage and execute malicious scripts from temporary locations.
Detects the execution of PowerShell with a bypass execution policy that performs a download or web request to save content to a file in the user's temp directory, followed by the immediate execution of that file. This pattern is characteristic of multi-stage malware droppers or fileless attack techniques attempting to stage and execute malicious scripts from temporary locations.
This rule detects scenarios where an AI agent executes shell commands or system-level tools immediately after receiving a prompt injection attack from an untrusted source. It correlates agent audit logs—specifically identifying tool calls flagged for prompt injection—with actual endpoint process creation events. It flags process execution as 'High' severity if the command line matches common malicious patterns like encoded commands, IEX, or attempts to access credential material (e.g., lsass, mimikatz).
This rule detects scenarios where an AI agent executes shell commands or system-level tools immediately after receiving a prompt injection attack from an untrusted source. It correlates agent audit logs—specifically identifying tool calls flagged for prompt injection—with actual endpoint process creation events. It flags process execution as 'High' severity if the command line matches common malicious patterns like encoded commands, IEX, or attempts to access credential material (e.g., lsass, mimikatz).
Detects >=2 of the four NeedyMantis archive-extraction artifacts (encryptbase64.ps1, dnsapi.dll, ws2_32.dll, msvcrt140.dll) written by the same process within 60 seconds. Anchored to the known sideload staging directories (ProgramData/ProgramFiles subfolders used by the Poedit/curl/Vim/TightVNC/Office/Broadcom/Intel/NVIDIA-masquerading bundles) and excludes System32/SysWOW64, since ws2_32.dll and dnsapi.dll are legitimate system DLL names that would otherwise cause noise if matched by name alone anywhere on disk.
Detects >=2 of the four NeedyMantis archive-extraction artifacts (encryptbase64.ps1, dnsapi.dll, ws2_32.dll, msvcrt140.dll) written by the same process within 60 seconds. Anchored to the known sideload staging directories (ProgramData/ProgramFiles subfolders used by the Poedit/curl/Vim/TightVNC/Office/Broadcom/Intel/NVIDIA-masquerading bundles) and excludes System32/SysWOW64, since ws2_32.dll and dnsapi.dll are legitimate system DLL names that would otherwise cause noise if matched by name alone anywhere on disk.
Detects >=2 of the four NeedyMantis archive-extraction artifacts (encryptbase64.ps1, dnsapi.dll, ws2_32.dll, msvcrt140.dll) written by the same process within 60 seconds. Anchored to the known sideload staging directories (ProgramData/ProgramFiles subfolders used by the Poedit/curl/Vim/TightVNC/Office/Broadcom/Intel/NVIDIA-masquerading bundles) and excludes System32/SysWOW64, since ws2_32.dll and dnsapi.dll are legitimate system DLL names that would otherwise cause noise if matched by name alone anywhere on disk.
Detects >=2 of the four NeedyMantis archive-extraction artifacts (encryptbase64.ps1, dnsapi.dll, ws2_32.dll, msvcrt140.dll) written by the same process within 60 seconds. Anchored to the known sideload staging directories (ProgramData/ProgramFiles subfolders used by the Poedit/curl/Vim/TightVNC/Office/Broadcom/Intel/NVIDIA-masquerading bundles) and excludes System32/SysWOW64, since ws2_32.dll and dnsapi.dll are legitimate system DLL names that would otherwise cause noise if matched by name alone anywhere on disk.
Detects the execution of PowerShell or PowerShell ISE where the parent process is the console host (conhost.exe) and the command-line arguments are either missing, empty, or represent an bare execution of the binary. This pattern is commonly associated with fileless execution techniques where attackers attempt to hide command-line arguments or evade logging.
Detects execution patterns indicative of 'ClickFix' social engineering, where a user is tricked into copying a command to their clipboard and executing it directly in a terminal. The rule monitors for processes that read clipboard contents (via PowerShell or clip.exe) and simultaneously invoke shell interpreters to execute the retrieved data.
Detects instances where cmd.exe or powershell.exe are launched from explorer.exe with command-line arguments containing DocuSign-themed keywords. This behavior is indicative of a 'ClickFix' phishing attack, where a user is socially engineered to copy and execute a malicious command via the terminal after interacting with a fraudulent DocuSign lookalike page.
Detects the silent installation or execution of Remote Monitoring and Management (RMM) tools when launched by script hosts (wscript.exe, mshta.exe, powershell.exe) which themselves were spawned by browser processes or explorer.exe. This pattern is characteristic of social engineering delivery chains, such as 'ClickFix', where a user is tricked into executing a script that subsequently fetches and runs RMM payloads for persistent remote access.
Detects the execution of 'filemanager.exe' and its subsequent access to sensitive browser credential stores (e.g., 'Login Data', 'cookies.sqlite'), occurring within a short window following a PowerShell-based ClickFix-style attack chain. The rule correlates initial suspicious script execution (often involving hidden windows, obfuscated commands, or web requests) with follow-on credential harvesting behavior on the same host.
Detects mshta.exe initiating outbound network connections, followed closely by the execution of a powershell.exe process with an unusually large command line, or PowerShell script block events containing large, potentially obfuscated scripts. This behavior is indicative of 'DeepLoad' or 'ClickFix' style staging, where legitimate binaries are leveraged to download and execute heavily obfuscated payloads.
Detects potential credential theft or malicious browser extension installation (DeepLoad-style) by monitoring for browser extension manifest file drops or registry-based extension force-installs occurring shortly after suspicious PowerShell command execution (ClickFix-style) on the same device.
Detects a potential ClickFix delivery attack where a user navigates to an automotive-themed website, interacts with the system via the Windows Run dialog (RunMRU), and subsequently executes command-line interpreters (powershell, cmd, wscript, mshta) spawned by explorer.exe within a short time window.
Detects the execution of PowerShell with suspicious command-line arguments and obfuscation techniques commonly used by attackers to execute malicious code, including base64 encoded commands, bypass of execution policies, dynamic assembly loading, and caret-based obfuscation.
Detects AI coding assistants and LLM agent frameworks spawning shell processes or interpreters to execute potentially malicious commands. The rule monitors for suspicious activity often associated with download cradles, credential access, reconnaissance, or persistence, while excluding standard interactive terminal usage.
Detects AI coding assistants and LLM agent frameworks spawning shell processes or interpreters to execute potentially malicious commands. The rule monitors for suspicious activity often associated with download cradles, credential access, reconnaissance, or persistence, while excluding standard interactive terminal usage.
Detects instances where a Claude process accesses a 'SKILL.md' file, followed closely by a suspicious command execution on the same device. The rule specifically targets command-line activity that involves encoding, download-and-execute patterns, staging in sensitive directories, or communication with suspicious domains/IPs, which is indicative of a supply-chain or poisoned agent-skill file attack.
Page 25 of 213