Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects suspicious child processes spawned by VS Code extension hosts (node.exe, code.exe, code-server, cursor) that indicate potential abuse, possibly related to WASM syscall/js bridge exploitation. The rule specifically looks for common command-line patterns used for downloading and executing payloads, such as those seen in GLASSWORM WASM loader attacks.
This rule detects the presence and execution of the GLASSWORM.WASM TinyGo-compiled WebAssembly loader. It identifies suspicious file creations of .wasm files or known malicious JavaScript shim files within VS Code extension directories, as well as the execution of node.exe loading .wasm files or known malicious JavaScript shims from these paths. Detection is based on specific file names, folder paths, and a known malicious SHA256 hash.
Detects the spawning of suspicious command-line interfaces or utility processes (e.g., cmd.exe, powershell.exe, curl.exe) by an AutoGen Studio Python process. This pattern is indicative of potential exploitation attempts where an adversary leverages AutoGen Studio's capabilities to achieve arbitrary code execution on the underlying host.
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
Detects shell commands querying attacker-controlled domains disguised as Apple driver stores to fetch malicious macOS backdoors, specifically looking for 'coreaudiod' or 'audio-issue-fix.sh' in the URL.
Detects the suspicious installation and execution of a Python runtime from within a disguised directory (%LOCALAPPDATA%\Programs\Python\Python3127). This behavior is characteristic of an infostealer campaign that leverages Node.js to download archive files (python.zip, python.7z) and archiving tools (7zr.exe) to bootstrap a Python-based malicious payload.
Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.
This rule detects processes launched from common user-writable or temporary directories (Downloads, AppData/Temp, etc.) that initiate a network connection more than 60 seconds after the process start time. This behavior is indicative of a delayed C2 beaconing or a dormant malicious payload being activated.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects the creation of hidden, dot-prefixed staging directories in /tmp/ or /var/tmp/ commonly associated with the 'lambsys' cryptominer dropper. The rule monitors for the creation of a hidden directory, multiple subsequent file drops (binaries or scripts), execution of chmod +x on these files, and final execution of the binary. A lower-severity alert is triggered when a non-interactive web server process creates such a directory.
This rule detects the use of common command-line utilities such as curl, certutil, and PowerShell to download files from a specific external domain ('thomphon.com') or to download a file named 'update.msi'. These activities are often associated with the staging of malicious payloads.
Detects the use of common Windows living-off-the-land binaries (certutil, bitsadmin, curl, powershell) to download external files, which is a common behavior associated with staging malware loaders such as MintsLoader and D3F@ck Loader.
Detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, brave.exe, opera.exe) initiate command-line utilities (cmd.exe, powershell.exe, wscript.exe) that include arguments indicative of downloading remote resources (curl, iwr, Invoke-WebRequest, bitsadmin, certutil). This pattern is frequently used to download and execute second-stage malicious payloads.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects the silent extraction of ZIP archives using the native Windows tar.exe utility into application data directories. This behavior is indicative of the Potemkin Loader, where attackers stage malicious payloads following an initial download to evade detection.
Detects the execution of 'rundll32' attempting to load 'installer.dll' and invoke its 'Begin' export function. This activity is often associated with malware, specifically the Clickfix campaign, which uses PowerShell's 'Invoke-WebRequest' to download the DLL.
Detects curl.exe downloading payloads to generic .dat or .exe files in AppData, or hitting known staging IPs.
Detects instances where 'RemotePCService.exe' or 'rpccmdhost.exe' (associated with remote access software) spawn 'powershell.exe' with suspicious command-line arguments. These arguments often indicate attempts to execute obfuscated commands, download content from the internet, or execute code in memory, which can be indicative of malicious activity leveraging legitimate remote access tools.
Detects when 'Cursor.exe' (a legitimate application) spawns common command-line utilities (cmd.exe, powershell.exe, pwsh.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe) with command-line arguments indicative of downloading files from the internet (e.g., containing 'http://', 'https://', 'ftp://', '-o', '-OutFile', 'iwr', 'DownloadString', 'DownloadFile'). This could indicate malicious activity where 'Cursor.exe' is being abused to facilitate ingress tool transfer or execute malicious payloads.
Page 69 of 121