Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
6
5
1
1
1
Contributors
4
3
1
1
1
Categories
10
8
5
4
2
Platforms
10
5
Products / Services
4
3
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
KQL Query from file: INC Ransomware Command Execution
KQL Query from file: INC Ransomware Command Execution
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
This rule detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell execution. It looks for specific VBScript functions and object creations like `CreateObject("MSXML2.DOMDocument.3.0")`, `CreateObject("Scripting.FileSystemObject")`, and `CreateObject("Wscript.Shell")`, as well as patterns related to Base64 decoding. Additionally, it identifies common malicious PowerShell usage through keywords such as `powershell.exe -nop`, `-encodedcommand`, `Invoke-Expression`, `DownloadString`, and various execution policy bypasses or obfuscation techniques. The rule also includes patterns for VBScript window manipulation and script language declarations.
This rule detects network traffic containing the string "signal(SIGTERM, SIG_IGN)" case-insensitively, indicating a process attempting to ignore the SIGTERM signal. This behavior can be used by malware or adversaries to achieve persistence on Linux systems by making a process harder to terminate gracefully.
KQL Query from file: INC Ransomware Command Execution
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
KQL Query from file: INC Ransomware Command Execution
Detects the use of a PowerShell download cradle, a technique observed in the PhantomCaptcha campaign to download and execute a next-stage payload. This pattern often involves stealthy flags to evade detection.
Detects a PowerShell command line pattern used by Snake Keylogger to download and execute a payload. This pattern involves using Invoke-WebRequest to fetch a file and Start-Process to run it, often with parameters to hide the execution window. The rule also looks for execution from a temporary directory, a common malware technique.
Find all machines running a given Powersehll cmdlet.
This covers all Powershell commands executed in the Powershell engine by any process.
This covers all Powershell commands executed in the Powershell engine by any process.
Detects the execution of binaries located in potentially suspicious locations, specifically within the '/tmp/' directory, using the 'nohup' command. This behavior is often associated with malware attempting to maintain execution even after a user logs off or a session terminates.
This rule detects the execution of the `nohup` command on Linux systems. `nohup` is a utility that allows a command to continue running in the background even after the user logs out or the terminal is closed. Attackers may leverage `nohup` to maintain persistence for malicious processes or to bypass restrictions in certain environments.
This rule detects the use of `Start-Process` with the `-PassThru` and `-FilePath` parameters in PowerShell script blocks. The `-PassThru` parameter allows `Start-Process` to return a process object, which can be used to interact with the started process in the background, potentially for stealthy execution or to bypass interactive prompts. The `-FilePath` parameter specifies the executable to run. This combination can be indicative of an adversary attempting to execute a process in a less conspicuous manner.