Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
This rule detects potentially malicious child processes spawned by Visual Studio Code (Code.exe) when using VS Code tasks (tasks.json). It identifies suspicious CLI arguments often associated with downloading, executing, or obfuscating scripts (e.g., PowerShell, curl, python, mshta) that are not part of standard development workflows like npm, yarn, or git, which are explicitly filtered out as noise.
Detects HTTP(S) requests to known SideCopy/ReverseRAT payload-delivery URLs identified in Operation SideCopy spear-phishing campaigns targeting Indian academia.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
Detects AI coding assistants and LLM agent frameworks spawning shell processes or interpreters to execute potentially malicious commands. The rule monitors for suspicious activity often associated with download cradles, credential access, reconnaissance, or persistence, while excluding standard interactive terminal usage.
Detects AI coding assistants and LLM agent frameworks spawning shell processes or interpreters to execute potentially malicious commands. The rule monitors for suspicious activity often associated with download cradles, credential access, reconnaissance, or persistence, while excluding standard interactive terminal usage.
This rule detects outbound HTTP requests to the blogspot.com domain, which is often used by malware for command-and-control (C2) communication, staging, or as an initial check-in mechanism. Attackers frequently abuse legitimate blogging platforms to host malicious content and evade network-based detections that might otherwise flag unknown or suspicious domains.
Detects the suspicious copying of the Windows certutil.exe binary to an alternate location (e.g., /Users/Public/Downloads/) followed by execution with decoding or caching flags. This behavior is indicative of an adversary attempting to use certutil as a LOLBin to decode or reassemble malicious payloads, a tactic frequently observed in Kimsuky-related LNK malware campaigns.
Detects instances where WScript.exe or CScript.exe spawn PowerShell.exe as a child process. The rule specifically looks for command-line arguments indicative of policy bypass (-ExecutionPolicy Bypass) and remote payload retrieval (Invoke-WebRequest, DownloadString), which is a common pattern in obfuscated JavaScript-based infection chains.
Detects specific FTP commands (STOR, RETR, TYPE I) and passive mode responses directed to or originating from identified malicious IP addresses associated with the LucidRook threat actor. This rule monitors for potential file exfiltration, payload retrieval, and command-and-control communication over the FTP protocol.
Detects outbound network traffic associated with identified ClickFix CPaaS payload domains and associated API endpoints. The rule monitors for specific malicious domain contact (comicstar.lat, babybon.cfd, merkantalolol.asia) and the use of the '/api/index.php?a=init' endpoint, which is indicative of the ClickFix payload delivery mechanism.
This rule detects the use of PowerShell to download common Remote Monitoring and Management (RMM) or remote access tools from the internet. This behavior is frequently associated with malicious actors attempting to establish persistent remote access to a compromised system.
Detects network beaconing activity associated with the TuxBot v3 IoT botnet. The rule identifies specific User-Agent strings (TuxBot/3, BusyBox wget, Wget/1.x), requests for .elf files, and connections to suspicious top-level domains frequently used for botnet command-and-control (C2) infrastructure.
Detects network traffic associated with AMOS (Atomic macOS) Stealer malware, identifying C2 beaconing and tasking requests. The rules specifically monitor POST requests to '/api/t' with JSON payloads and GET requests to '/api/shell/agent' over non-standard ports (excluding 80 and 443).
Detects HTTP GET requests to external URIs matching a specific pattern (a 10-20 character hexadecimal path followed by ?force=1), which is characteristic of the delivery or staging mechanism used by MacStealer (Macfinger) and Atomic macOS Stealer (AMOS) malware families.
Detects HTTP GET requests associated with the delivery of AMOS (Atomic macOS Stealer) payloads. This rule monitors for specific URL patterns (force=1) used by stager scripts to fetch Mach-O binary payloads from known malicious infrastructure or matching known malicious file hashes.
Detects HTTP GET requests associated with the delivery of AMOS (Atomic macOS Stealer) payloads. This rule monitors for specific URL patterns (force=1) used by stager scripts to fetch Mach-O binary payloads from known malicious infrastructure or matching known malicious file hashes.
Detects a specific staging and execution pattern where a payload file with a 6-16 character random filename is written to a temporary directory and subsequently executed by a common Windows handler process (such as rundll32, regsvr32, or powershell) within a 60-second window. This behavior is indicative of the Sauron Loader task-execution workflow.
Detects a specific staging and execution pattern where a payload file with a 6-16 character random filename is written to a temporary directory and subsequently executed by a common Windows handler process (such as rundll32, regsvr32, or powershell) within a 60-second window. This behavior is indicative of the Sauron Loader task-execution workflow.
Detects a suspicious pattern where an endpoint initiates an HTTP GET request to a known staging IP with a specific 'force=1' parameter, followed by the execution of a bash shell process. This behavior is associated with the ClickFix attack chain used to deliver AMOS Stealer payloads on macOS.
Detects the Sauron Loader malware pattern where a payload is downloaded or retrieved and written to a randomly named file within a temporary directory, followed by the immediate execution of that staged file. This behavior is indicative of C2 tasking involving payload staging.
Page 28 of 121