Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
183
90
20
18
12
Contributors
85
73
57
47
29
Categories
300
166
46
9
9
Platforms
317
25
6
4
3
Products / Services
127
58
46
9
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
9
8
1
1
1
IDS Classtypes
2
IDS Protocols
2
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
Detects the execution of ServiceModelReg.exe from the standard .NET Framework directories. While this utility is a legitimate tool used for registering and configuring WCF components, its abuse has been observed in the wild by threat actors, including the OnyxC2 malware, to leverage built-in Windows utilities for suspicious activities.
Detects the execution of diskshadow.exe with the /s (scripted) flag, followed by file access to sensitive Windows credential files (ntds.dit or SAM). This behavior indicates the abuse of the Windows Diskshadow utility to create a volume shadow copy for the purpose of offline credential exfiltration.
Detects instances where FortiClient EMS management daemon processes (FCMDaemon.exe, FortiClient_Server.exe, or FCMWebServer.exe) spawn suspicious child processes often associated with living-off-the-land techniques, such as command shells, scripting interpreters, or system administrative utilities.
Detects mshta.exe spawning suspicious child processes (cmd.exe, powershell.exe, or reg.exe) that are characteristic of the ReverseRAT backdoor. The rule identifies common discovery commands or persistence attempts via Registry Run keys triggered from mshta.exe.
Detects the abuse of the forfiles.exe utility to indirectly execute command-line interpreters such as cmd.exe, powershell.exe, or other common LOLBins. Adversaries use this technique to bypass security controls that monitor or restrict direct execution of these interpreters.
Detects the execution of diskshadow.exe with the /s (scripted) flag, followed by file access to sensitive Windows credential files (ntds.dit or SAM). This behavior indicates the abuse of the Windows Diskshadow utility to create a volume shadow copy for the purpose of offline credential exfiltration.
Detects the invocation of Windows Subsystem for Linux (WSL) binaries (wsl.exe or wslconfig.exe) using command-line arguments that enable arbitrary command execution, such as -e, --exec, or shell interpreters (bash -c, sh -c), or web-based retrieval tools like curl/wget. This technique is often used to execute commands or download payloads within a Linux environment on Windows, potentially bypassing security controls focused on native Windows processes.
Detects mshta.exe spawning suspicious child processes (cmd.exe, powershell.exe, or reg.exe) that are characteristic of the ReverseRAT backdoor. The rule identifies common discovery commands or persistence attempts via Registry Run keys triggered from mshta.exe.
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
Detects mshta.exe spawning suspicious child processes (cmd.exe, powershell.exe, or reg.exe) that are characteristic of the ReverseRAT backdoor. The rule identifies common discovery commands or persistence attempts via Registry Run keys triggered from mshta.exe.
Detects instances where the IIS worker process (w3wp.exe) spawns common command-line or system utilities often used for post-exploitation activities, specifically when command-line arguments contain references to 'MSExchange' or 'Exchange'. This behavior is frequently associated with exploitation attempts against Microsoft Exchange servers, such as the ProxyLogon chain, where a web shell or other malicious script might be used to execute commands via the IIS process.
Detects the execution of the Program Compatibility Assistant (pcalua.exe) with the '-a' flag to launch executables located in common user-writable directories such as Temp, Downloads, or AppData. This behavior is a known Living off the Land Binaries and Scripts (LOLBAS) technique used to proxy execution and potentially bypass security controls or break parent-child process lineage.
Detects the sequential execution of multiple Microsoft-signed LOLBins (Living Off the Land Binaries) spawned by the same parent process (PowerShell or CMD) within a 5-minute window. This behavior is indicative of a cascading fallback mechanism used by post-exploitation tools to bypass application allowlisting or security controls.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.
The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content
changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied
from a browser are subsequently executed on the Windows system through the Run dialog box.
changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied
from a browser are subsequently executed on the Windows system through the Run dialog box.
Detects a Parallels appliance tar archive containing a directory entry name with an embedded double-quote character followed by the --use-compress-program flag, characteristic of the ParaShells (CVE-2026-90894) tar argument-injection payload
Detects a Parallels appliance tar archive containing a directory entry name with an embedded double-quote character followed by the --use-compress-program flag, characteristic of the ParaShells (CVE-2026-90894) tar argument-injection payload
Detects execution of the tar utility by the prl_disp_service process with a command line pattern indicative of command injection via the --use-compress-program flag. This technique is often used to execute arbitrary commands by embedding them within the compression program argument.
Page 2 of 17