Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the creation of .amazonq/mcp.json or mcp.json files within repository directories following a git clone operation. This behavior is associated with the exploitation of vulnerabilities (such as CVE-2026-12957) where attackers use malicious job-interview repositories to trigger automatic execution of arbitrary MCP (Model Context Protocol) servers in the Amazon Q Developer extension in VS Code, potentially leading to unauthorized credential or sensitive data access.
Detects Microsoft Office applications spawning common LOLBAS (Living Off the Land Binaries and Scripts) such as PowerShell, CMD, WScript, or MSHTA. This activity is a common indicator of macro-based attacks or document-based exploitation attempting to execute arbitrary code or scripts.
Detects the execution or loading of executables (.exe) or dynamic link libraries (.dll) located in user-specific temporary or roaming directories (AppData). These directories are common locations for attackers to drop payloads, execute malicious code, or achieve persistence, as they are writable by standard users without elevated privileges. The rule includes filters for known legitimate processes that may perform operations in these directories to reduce noise.
Detects the execution of Microsoft Edge via the command shell to open a PDF file. This pattern can be indicative of malicious activity where an attacker attempts to bypass direct execution or leverage a browser vulnerability to open a malicious PDF.
This rule detects instances where Microsoft Excel (excel.exe) acts as a parent process for suspicious child processes, including command-line interpreters (cmd.exe, powershell.exe), scripting hosts (wscript.exe, cscript.exe, mshta.exe), or binary proxies (rundll32.exe, regsvr32.exe). This pattern is commonly associated with weaponized office documents executing malicious payloads via macros or other embedded scripts.
Detects suspicious child processes spawned by Microsoft Office applications (Word, Excel, WordPad, Outlook) which are characteristic of exploitation attempts, such as CVE-2017-0199. The rule monitors for execution of command-line tools (mshta, powershell, cmd, wscript, cscript) known to be used by malicious macro-enabled documents or exploit documents to download and execute secondary payloads.
Detects instances where common browser processes (e.g., Chrome, Edge, Firefox) spawn command-line tools or scripting interpreters such as PowerShell, cmd, mshta, or rundll32. This pattern is characteristic of 'ClickFix' social engineering attacks where users are tricked into executing malicious commands under the guise of troubleshooting or CAPTCHA resolution.
Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.
Detects ClickFix attack patterns where users are coerced into pasting malicious PowerShell commands into the Windows Run dialog (explorer.exe). The command uses clipboard access (Get-Clipboard) or network download/execution (iwr, iex) methods, commonly associated with the Potemkin Loader or RMM-based distribution campaigns.
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
Detects anomalous child process execution spawned by Lunar Client or associated Java runtime processes, typically stemming from a malicious Modrinth modpack. This exploit path leverages Electron framework vulnerabilities to execute arbitrary system binaries (e.g., cmd.exe, powershell.exe, explorer.exe) via shell commands triggered by modpack installation or execution.
Detects execution of processes by masqueraded lure executables associated with Mustang Panda campaign themes (e.g., India-Taiwan relations, hydropower projects) spawning known LOLBins like rundll32.exe, regsvr32.exe, or PowerShell, indicating potential side-loading or malicious loader activity.
Detects spearphishing activity involving project-related lure archives, subsequent file drops of potentially malicious DLLs and executables (sideloading indicators), and the execution of processes masquerading as the lure documents.
Detects Microsoft Office applications spawning suspicious child processes (e.g., cmd.exe, rundll32.exe) or initiating network connections to WebDAV paths, which may indicate exploitation of ActiveX OLE auto-execution vulnerabilities.
This rule detects the creation of specific temporary directories following a pattern often used by installers or malware, and the subsequent writing of 'wermgr.exe' (Windows Error Reporting manager) into these temporary locations. This behavior is indicative of potential masquerading or process hijacking attempts, where a malicious executable is disguised as a legitimate Windows process by operating from an unexpected, temporary directory.
Detects suspicious activities related to the RoguePlanet vulnerability (CVE-2026-50656), characterized by the creation of temporary directory structures in user folders, mounting of disk images (ISO/VHD) from user-accessible paths, and subsequent execution of binaries from these temporary workspaces.
This rule monitors for potential spearphishing campaigns by tracking two behaviors: the delivery of emails containing known malicious URLs or lure-themed attachment names via email gateway logs, and the subsequent execution of files extracted from archives or matching lure patterns by EDR agents on endpoints.
Detects suspicious PowerShell activity potentially associated with the 'Ptero' malware family. The rule correlates several behaviors: direct invocation of PowerShell with known Ptero-related script names, execution spawned by common phishing delivery parents (such as Office applications or web scripting engines), PowerShell downloading files from Cloudflare Workers domains, and the correlation of PowerShell network download activity with subsequent registry-based persistence modifications.
Detects the execution of known remote access and monitoring software (RMM/RAT) when launched as a child process of common web browsers or email clients. This behavioral pattern is frequently observed in phishing attacks where users are tricked into downloading and executing remote support tools, a technique often associated with the Luna Moth (Silent Ransom Group) campaign.
Detects the spawning of Windows Script Host (wscript.exe or cscript.exe) as a child process of common web browsers (chrome.exe, msedge.exe, firefox.exe). This pattern is often indicative of a drive-by download attack or a user executing a malicious script file downloaded from the internet.
Page 48 of 86