Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
Detects suspicious child processes (such as shell interpreters or downloader tools) spawned by Langflow, uvicorn, or python processes. The rule focuses on common indicators of post-exploitation activity, including code execution via python arguments, use of curl/wget to pull payloads, and execution of shell scripts often associated with malware droppers.
Detects suspicious usage of the Bun runtime, specifically when it is spawned by common Node.js development processes (like npm or node-gyp) or downloaded from non-official sources using command-line tools or browsers. This behavior is associated with the Miasma malware campaign, which abuses the Bun runtime for malicious operations.
Detects web browsers or file explorer spawning common script interpreters (PowerShell, CMD, mshta, etc.) with command-line arguments indicative of malicious activity, such as encoded commands, Base64 strings, or web-based script downloads, typical of ClickFix or similar browser-based social engineering attacks.
This rule detects the use of the native Windows 'tar.exe' utility to extract a ZIP archive into an AppData staging path. This behavior is associated with the Potemkin Loader, which downloads a ZIP payload and then silently extracts it. The rule specifically looks for 'tar.exe' being executed with the command-line arguments '-xf' followed by a ZIP file and '-C' followed by a path containing 'AppData'.
Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.
Detects wscript.exe executing VBScript that uses the MSXML2.XMLHTTP component to perform an HTTP GET request to a specific Kimsuky C2 URL (acnms.dmdoc.dynv6.net). This activity is associated with a multi-stage infection chain where a VBScript file retrieves and executes a subsequent stage from the specified remote endpoint.
Detects the use of PowerShell to silently download and install a Remote Monitoring and Management (RMM) tool, identified by common RMM executable names and silent installation parameters.
Detects suspicious process execution patterns where VS Code (code.exe) spawns interpreter processes (node.exe, python.exe) followed by network connections to known staging infrastructure (e.g., jsonkeeper.com, vercel.app). This behavior is characteristic of the 'Contagious Interview' campaign attributed to the Lazarus Group, used to deploy BeaverTail and InvisibleFerret malware following social engineering lures.
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
This rule detects a multi-stage activity chain where a user performs a git clone, followed by Visual Studio Code, Node, or Python spawning a shell or interpreter, which then initiates a network connection to known suspicious staging infrastructure. This behavior is indicative of a developer machine being compromised to exfiltrate code or download malicious payloads.
This rule identifies suspicious activity involving potential trojanized software installers and connections to known typosquatting or malicious domains. It flags processes spawned by common web browsers that match known malicious installer filenames and monitors for DNS queries to domains frequently associated with software supply chain or distribution-based malicious activity.
This rule monitors network traffic for specific command-and-control (C2) communication patterns associated with the Ousaban banking trojan. It detects response packets from an external server to a client machine containing JSON-like structural indicators such as 'inicio{', 'host', and 'porta' followed by '}fim'.
Detects the use of the native Windows curl.exe utility to download a ZIP archive from a remote location, a technique used by the Potemkin Loader to retrieve malicious RMM components while avoiding PowerShell-based security controls.
Detects suspicious execution of command-line utilities (cmd, powershell, pwsh) spawned by Windows Explorer (explorer.exe). The rule flags processes with long command lines or those containing evidence of obfuscation (Base64 encoding) or common command-line indicators used for weaponized scripts, such as download requests or expression invocation.
Detects the execution and download of the 'isp.sh' shell dropper and the 'lambsys' Go-based cryptominer binary on Linux systems. This rule monitors for common dropper patterns, including shell execution of piped commands, use of curl/wget to fetch known malicious components, and instances where Langflow processes attempt to spawn shell-related child processes for potential payload execution.
Detects activity associated with the TA4922 (Silver Fox) threat actor, specifically involving Atlas RAT and RomulusLoader. The detection logic utilizes four primary telemetry sources: network connections to known C2 IP addresses, DNS queries for the 'srt.tw' domain, suspicious outbound connections from user-writable directories (AppData, Temp, etc.) over non-standard ports, and the execution of a specific malicious ZIP archive file identified by its SHA256 hash.
Detects exploitation attempts against Langflow targeting unauthenticated API endpoints (/api/v1/build_public_tmp or /run) for remote code execution, as well as downstream process spawning activity on Linux hosts where Python processes execute shell commands (e.g., curl/wget piping to sh) to download known malicious dropper payloads.
Detects suspicious file downloads from the internet where common DLLs (wininet.dll, urlmon.dll, msxml3.dll) are initiating the file creation of executable, DLL, PowerShell, or batch files. The rule specifically looks for scenarios where 5 or more such files are created by the same initiating process on a device, indicating potential malicious activity like ingress tool transfer.
Detects outbound network connections to known BumbleBee loader and AdaptixC2 infrastructure, or DNS lookups for BumbleBee download gateway domains. The rule further filters these network events by inspecting the source process to ensure it matches common LOLBAS (Living Off the Land Binary and Scripting) utilities or execution from temporary user paths, indicating potential malicious payload retrieval.
Detects the use of common Windows command-line utilities (powershell.exe, cmd.exe, bitsadmin.exe, curl.exe) executing files from common temporary directories (%TEMP%, %tmp%). The rule flags execution involving hidden windows, specific file names (flt.bin, FLTLIB.dll, etc.), or known C2 IP addresses.
Page 59 of 121