Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects a command shell using cURL to download an MSI package and immediately install it silently with msiexec, matching a reported RMM delivery workflow. This rule specifically looks for command-line executions involving 'cmd.exe', 'powershell.exe', or 'pwsh.exe' that use 'curl' to download a '.msi' file and then execute 'msiexec' with silent installation flags.
This rule detects network communication associated with the 'easy-day-js Mastra npm Supply Chain' compromise. The first alert identifies C2 exfiltration attempts over TLS to a specific IP address (23.254.164.123) on port 443. The second alert identifies a stage-2 payload download from another specific IP address (23.254.164.92) on port 8000, specifically looking for the URI '/update/49890878'. These indicators are linked to the 'protocal.cjs' and 'setup.cjs' malware, respectively, and are part of a supply chain attack.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with command-line arguments that indicate an output file ending in '.zip' and a URL, followed by a file creation event for a '.zip' file.
Detects network connections where the user-agent string contains 'NSIS_InetLoad' and 'Mozilla', often indicative of a staged downloader. The rule also checks if the principal process is an executable and attempts to capture the user-agent from the URL or process command line.
This rule detects instances where mshta.exe is used to execute a remote resource with a .7z file extension. This behavior is often indicative of an adversary attempting to bypass traditional security controls by disguising malicious script content as a compressed archive, as observed in some malware distribution campaigns.
This rule detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell execution. It looks for specific VBScript functions and object creations like `CreateObject("MSXML2.DOMDocument.3.0")`, `CreateObject("Scripting.FileSystemObject")`, and `CreateObject("Wscript.Shell")`, as well as patterns related to Base64 decoding. Additionally, it identifies common malicious PowerShell usage through keywords such as `powershell.exe -nop`, `-encodedcommand`, `Invoke-Expression`, `DownloadString`, and various execution policy bypasses or obfuscation techniques. The rule also includes patterns for VBScript window manipulation and script language declarations.
Detects instances where the AutoGen Studio process, or a process with 'autogenstudio' in its command line, initiates suspicious subprocesses such as command shells (cmd, powershell, bash, sh) or common living-off-the-land binaries (certutil, mshta, rundll32, regsvr32, curl, wget, bitsadmin, python). This behavior is characteristic of an adversary leveraging a potentially vulnerable application to execute arbitrary code on the underlying system.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
This detection looks for various LOLBAS Processes that have download capabilities but are often seen rarely making network connections. They can be identified from the LOLBAS Project: https://lolbas-project.github.io/#/download
Seen in various campaigns including recent clickfix activity
Seen in various campaigns including recent clickfix activity
Detects a multi-stage infection sequence characteristic of common IoT botnets (such as Mirai variants). The detection triggers when a sequence of events occurs on the same device within a 5-minute window: downloading a file from a URL using wget or curl to /tmp/, modifying the file permissions using chmod 777, and subsequently executing the binary. An optional cleanup phase involving removal of files from /tmp/ is also correlated.
Detects the Matanbuchus loader downloading and writing the AstarionRAT executable payload to disk in the AppData directory, specifically when initiated by rundll32.exe.
Detects the infostealer communicating with raw.githubusercontent.com to pull secondary modules or exfiltrate small data fragments via URL params, specifically when initiated by 'python.exe'.
Detects SimpleHelp executing PowerShell to download ransomware encryptor payloads (like LockBit or BlackCat) from external, untrusted infrastructure. This rule specifically looks for PowerShell commands using Invoke-WebRequest or Net.WebClient to download executable, DLL, or ZIP files, where the initiating process is 'JWrapper' (associated with SimpleHelp).
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit a vulnerability (e.g., CVE-2026-20841) to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
Detects command-line execution containing keywords associated with Guloader (e.g., 'guloader', 'gupl') or generic download indicators (e.g., 'download' combined with protocol identifiers like 'http', 'https', 'ftp'). This typically indicates the malicious downloading of payloads by the Guloader malware family.
This rule detects the behavior of a temporary executable making a network connection and then deleting itself shortly afterwards. It specifically looks for file creation and deletion events of executables within temporary directories (e.g., \temp or \appdata\local\temp) where the context process is a command-line interpreter or another executable. The rule's logic is designed to identify specific malware structures like SessionGate, Remus, or AnimateClipper rather than generic executable names.
Detects the legitimate Notepad++ updater process (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was used to launch malicious payloads.
This rule detects the execution of PowerShell, wscript, or cscript with command-line arguments containing "Invoke-WebRequest" or "curl" in conjunction with specific keywords like "guloader", "etherhiding", or "clickfix". This combination suggests an attempt to download or execute malicious payloads associated with these campaigns or malware families.
Detects a DAEMON Tools helper process launching cmd.exe and PowerShell with WebClient or DownloadFile methods. The process ancestry is unusual for disk-emulation software and matches the compromised update chain.
Detects a multi-stage execution chain where PowerShell is used to download or reference the portable WinPython environment (WPy64-31401), followed by the execution of pythonw.exe within that context, which is indicative of the ModeloRAT malware.
This rule detects suspicious command-line activity that may indicate the leakage of API keys, specifically those resembling OpenAI API keys (starting with 'sk-', 'sk_live_', or 'sk_test_'). It looks for these patterns in conjunction with common data transfer utilities like curl, wget, powershell, or python, when executed by a process that is not a standard shell or explorer process. The rule triggers if two or more such events occur within an hour on the same computer.
Page 75 of 121