Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the execution of mshta.exe with a command line referencing an HTA file, followed within 10 minutes by a network connection initiated by mshta.exe to a remote URL containing .js or .xml extensions. This behavior is indicative of mshta.exe being used as a proxy to execute remote malicious payloads, a common technique for fileless malware execution and defense evasion.
Detects the creation of a hidden file named '.Outlook' within the user's AppData Roaming directory. This behavior is atypical for standard Outlook operations and may indicate malicious activity, such as configuration tampering, persistence mechanisms, or data staging by malware.
Detects the use of PowerShell's 'WriteAllBytes' method to write a file to the user's Local AppData Temp directory, immediately followed by the creation of a known or suspicious executable file in that same location. This pattern is commonly indicative of a stage in a fileless-style malware attack or automated payload delivery.
Detects code injection attempts targeting the Windows Media Network Sharing Service (wmpnetwk.exe), specifically monitoring for the loading of suspicious or common networking-related DLLs into this process. This behavior is indicative of an adversary attempting to mask malicious activity within a legitimate system process.
Detects a Parallels appliance tar archive containing a directory entry name with an embedded double-quote character followed by the --use-compress-program flag, characteristic of the ParaShells (CVE-2026-90894) tar argument-injection payload
Detects a Parallels appliance tar archive containing a directory entry name with an embedded double-quote character followed by the --use-compress-program flag, characteristic of the ParaShells (CVE-2026-90894) tar argument-injection payload
Detects execution of the tar utility by the prl_disp_service process with a command line pattern indicative of command injection via the --use-compress-program flag. This technique is often used to execute arbitrary commands by embedding them within the compression program argument.
Detects execution of the tar utility by the prl_disp_service process with a command line pattern indicative of command injection via the --use-compress-program flag. This technique is often used to execute arbitrary commands by embedding them within the compression program argument.
Detects high-frequency file creation, opening, or modification events within the Windows AppData Local Temp directory. This behavior, often involving specific obfuscated file names or known malicious process names, is a common indicator of malware payload staging or execution patterns, such as those observed in AsyncRAT infections.
Detects the activity of the PIVOTPIPE .NET loader, which involves writing specific artifacts (core.pak, agent.json, pk.der, or sleepmask.o) to a temporary directory with the 'nb_' prefix or the creation of debug files containing strings associated with in-memory reflective loading of a remote access tool (RAT).
This rule detects PowerShell commands that utilize specific character array joining techniques (e.g., [char]nnnn -join '') often used to obfuscate malicious strings or bypass keyword-based security filters. This is a common tactic for evading detection when downloading or executing payloads.
Detects child processes spawned by 7z.exe when it is executed from the 'C:\Users\Public\Documents\' directory. This is consistent with the behavior of the GRAYRABBIT backdoor, where a trojanized 7z.dll or boy.dll is sideloaded into the 7z.exe process to facilitate silent arbitrary process execution.
Detects child processes spawned by 7z.exe when it is executed from the 'C:\Users\Public\Documents\' directory. This is consistent with the behavior of the GRAYRABBIT backdoor, where a trojanized 7z.dll or boy.dll is sideloaded into the 7z.exe process to facilitate silent arbitrary process execution.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects the execution of known PAPERMILL/VenomRAT loader samples, identified by specific suspicious file names. The detection monitors for the initiation of these processes, followed by a delayed (5-10 minutes) creation of RunOnce registry persistence entries that masquerade as RuntimeBroker.
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
This rule detects scenarios where a device registration event occurs within 15 minutes of a device-code authentication sign-in for the same user. This pattern is indicative of potential account manipulation where an adversary registers their own device to an existing account to maintain persistent access or bypass multi-factor authentication (MFA).
Page 133 of 864