Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the use of 'curl' to perform a network request (likely for a remote script) and immediately piping that output to 'osascript' for execution in memory. This pattern is often used to execute malicious AppleScript payloads directly without writing to the disk, a technique seen in recent macOS infostealer campaigns.
This rule detects the execution of potentially malicious command-line patterns (involving base64 decoding, pipes to sh/zsh, and network-fetching utilities like curl) within Terminal.app processes on macOS. It correlates these command executions with prior web browser activity within a 5-minute window, effectively identifying potential 'ClickFix' social engineering lures where users are coerced into copying and pasting malicious instructions into their shell.
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
Detects instances where a web browser process creates a new executable file (.exe) in the 'Downloads' folder without a corresponding network connection event recorded by the browser to an executable URL. This pattern is indicative of potential in-browser assembly of a malicious file or an executable being dropped via non-standard browser download pathways, such as through local file system manipulation or hidden secondary processes.
Detects rundll32.exe executing a DLL that was written to a user-profile/AppData path within the preceding 15 minutes, consistent with CountLoader's taskType 3 command dispatch downloading and invoking an attacker-specified exported function.
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
TOKYOCORE RansomAgent User-Agent HTTP Traffic to Public File Hosting Service
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects file staging activity by AppVShNotify.exe, the legitimate App-V binary abused by NightLedger via DLL search-order hijacking. NightLedger's C2 command dispatcher supports Command ID 20 (download file), Command ID 27 (copy file), and Command ID 62 (delete file), which manifest as file create/delete activity performed by this hijacked host process. To reduce noise from genuine App-V client operation, the rule fires either when AppVShNotify.exe is observed loading the rogue SspiCli.dll (the sideloaded hijack DLL) or when the process performs file create/delete activity against paths outside the standard App-V cache/staging directories.
Detects the execution of suspicious commands, PowerShell scripts, or LOLBins (Living-off-the-Land Binaries) - commonly seen in ClickFix and CrashFix campaigns - recorded in the Windows 'RunMRU' registry key.
Detects potential post-exploitation activity originating from the SharePoint worker process (w3wp.exe). The rule monitors for three primary indicators: w3wp.exe spawning command interpreters (cmd.exe or powershell.exe), unauthorized file modifications or creations within SharePoint web directories, and outbound network connections to public IP addresses initiated by w3wp.exe, which may indicate payload delivery or C2 communication. (CVE-2026-50522)
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects the XCSSET bash stager downloading and executing a second-stage payload via curl to /tmp/ap from the amzndev.in C2 domain to begin host reconnaissance.
Detects file staging activity by AppVShNotify.exe, the legitimate App-V binary abused by NightLedger via DLL search-order hijacking. NightLedger's C2 command dispatcher supports Command ID 20 (download file), Command ID 27 (copy file), and Command ID 62 (delete file), which manifest as file create/delete activity performed by this hijacked host process. To reduce noise from genuine App-V client operation, the rule fires either when AppVShNotify.exe is observed loading the rogue SspiCli.dll (the sideloaded hijack DLL) or when the process performs file create/delete activity against paths outside the standard App-V cache/staging directories.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
SNOWBELT time-based DGA S3 bucket manifest retrieval
Page 52 of 121