Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects upload of potentially malicious VIB packages to ESXi hosts
This rule detects multiple outbound network connections to a specific set of known malicious C2 IP addresses on specific ports within a one-hour window. This behavior is indicative of a multi-payload delivery pattern associated with malware families such as Remcos, Agent Tesla, and RedLine.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless Zsh loaders. This rule identifies the execution of Zsh, Bash, or Sh processes that combine 'eval', 'base64', and 'gzip' with 'curl' or 'osascript' in their command line, often including redirection to /dev/null. This combination indicates an attempt to fetch and execute a gzipped and base64-encoded payload directly in memory.
Detects suspicious execution of command-line utilities (cmd, powershell, pwsh) spawned by Windows Explorer (explorer.exe). The rule flags processes with long command lines or those containing evidence of obfuscation (Base64 encoding) or common command-line indicators used for weaponized scripts, such as download requests or expression invocation.
This rule monitors for the execution of the 'bun.exe' process specifically when it originates from a Node.js-related context (such as npm, node-gyp, or binding.gyp execution) or exhibits suspicious behaviors like executing payloads from /tmp directories. This pattern is often associated with supply chain attacks or malicious package execution within JavaScript development environments.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects unexpected shell command execution spawned by the Amazon Q Developer VS Code extension processes (e.g., 'amazonq-lsp'). This activity is consistent with patterns related to the exploitation of CVE-2026-12957, involving the potential auto-execution of unauthorized commands via MCP (Model Context Protocol) server configurations or malicious inputs.
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
This rule detects processes running from common user-writable directories (AppData, Temp, ProgramData, etc.) that concurrently establish outbound network connections to non-private (non-RFC1918) IP addresses. It explicitly excludes common browsers, accessibility tools, and known Windows system or product-related paths to reduce noise.
Detects the use of the native Windows curl.exe utility to download a .zip file from an external URL, followed by the creation of that file on the disk. This pattern is associated with the Potemkin Loader which uses this technique to fetch RMM components, effectively bypassing PowerShell-based detection mechanisms for file downloads.
Detects execution of PowerShell commands using suspicious combinations of flags, obfuscation techniques, or indicators often associated with fileless malware delivery, such as Base64 encoded commands, hidden window execution, and memory-resident loading (e.g., Invoke-Expression, IEX, VirtualAlloc). The rule scores based on the combination of indicators, flagging highly suspicious patterns.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
Detects the use of BITSAdmin to create or modify background intelligent transfer jobs. Attackers often abuse BITSAdmin to download malicious payloads (ingress tool transfer) or to execute commands when a transfer job completes or errors, which can be leveraged for persistence or arbitrary code execution.
Detects execution of Certutil.exe with arguments commonly used by adversaries for downloading files (urlcache) or decoding malicious payloads (decode/decodehex). These techniques are frequently used to bypass security controls and facilitate the delivery of secondary payloads or tools.
Detects the use of BITSAdmin to create or modify background intelligent transfer jobs. Attackers often abuse BITSAdmin to download malicious payloads (ingress tool transfer) or to execute commands when a transfer job completes or errors, which can be leveraged for persistence or arbitrary code execution.
Detects network connection events initiated by the OneDrive sync process (OneDrive.Sync.Services.exe) to known malicious domains or suspicious specific file paths, which may indicate unauthorized use of the OneDrive process for command-and-control communication or malicious file retrieval.
Detects instances where the SQL Server process (sqlservr.exe) spawns suspicious child processes, which is a common indicator of Remote Code Execution (RCE) exploitation. This includes the execution of command shells (cmd, powershell), web clients (curl, wget), and other utilities commonly used for post-exploitation staging and payload delivery, such as those associated with potential xp_cmdshell abuse.
Detects instances where the Windows Subsystem for Linux (WSL2) wsl.exe process is used to execute curl or wget from the Windows host. This technique is often used to stage payloads or download tools from the internet, effectively bypassing Windows-based EDR network monitoring as the network connection occurs within the isolated WSL2 environment.
Detects indicators associated with the JDY botnet targeting SOHO and IoT infrastructure. The rule monitors for suspicious firmware update attempts to non-vendor hosts, identifies high-rate outbound scanning from edge devices, and flags devices that show re-emergence of suspicious behavior after a quiet period.
Detects the execution of batch scripts that invoke file transfer utilities (certutil, bitsadmin, or powershell) to download components into temporary directories, a behavior associated with the Red Lamassu campaign.
Page 64 of 121