Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects instances where the NW.js (Node-Webkit) framework binaries (nw.exe, node.exe) spawn common command-line interpreters or script-hosting utilities (e.g., cmd.exe, powershell.exe, wscript.exe) while executing associated application files like main.js or nw.pak. This behavior is indicative of potential exploitation of a browser-based application to gain shell access or execute arbitrary code on the host system.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects command-line execution patterns consistent with the SloppyRAT stager, specifically using IronPython to execute base64-encoded and zlib-compressed payloads from suspicious directories like AppData or Local. The rule looks for the simultaneous presence of encoding/compression indicators and execution primitives (subprocess or Popen).
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects instances where PowerShell is launched with explorer.exe as its parent process, but where the child process's metadata (creation time, logon ID, or account SID) does not align with the recorded explorer.exe process. This discrepancy is a strong indicator of Parent Process ID (PPID) spoofing, a technique often used to evade security monitoring.
Detects the presence of Chrome Remote Desktop processes or execution of Windows Installer (msiexec.exe) and GoogleUpdate.exe, which are often used by adversaries for remote access or as a proxy for malicious payload execution.
Adversaries may carry out malicious operations using a virtual instance to avoid detection
Detects anomalous remote interactive or network logons where the specific account and remote host/IP combination has not been observed in the previous 14 days. The rule correlates these new login events with subsequent process execution on the destination host within a short window (5 minutes) to identify potential lateral movement where an adversary uses valid credentials to log in and immediately execute commands.
Detects anomalous remote interactive or network logons where the specific account and remote host/IP combination has not been observed in the previous 14 days. The rule correlates these new login events with subsequent process execution on the destination host within a short window (5 minutes) to identify potential lateral movement where an adversary uses valid credentials to log in and immediately execute commands.
Detects the RejectDirectSend bypass (null SMTP envelope sender + internal-domain spoof). Tightened to require Microsoft's composite auth verdict OR all of SPF/DKIM/DMARC failing (vs. any one), excludes known-approved Direct Send relay IPs, and excludes likely-legitimate bulk/newsletter traffic via BulkComplaintLevel.
Detects potential abuse of MSBuild.exe or DotNet.exe as a proxy for executing arbitrary code. The rule identifies processes executing MSBuild or specific DotNet CLI operations (build, publish, test, pack) that do not originate from expected binary names, indicating a possible attempt to bypass application execution defenses using trusted developer utilities.
This rule detects the presence or execution of a file named 'GlobalProtect.exe' within the Palo Alto GlobalProtect directory. It focuses on identifying potentially masqueraded or unauthorized binaries by monitoring file events and associated process execution. This pattern is commonly used by attackers to disguise malicious files as legitimate security software to evade detection.
Detects the execution of an unsigned binary named '.macos' located within a 'Contents/MacOS/' directory structure, which is a common pattern for malicious applications attempting to masquerade or hide their execution profile on macOS.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
Detects potential credential harvesting or process memory manipulation against browser processes (Chrome or Edge). The rule monitors for unauthorized debugging activity initiated against browser processes (e.g., using flags like DEBUG_PROCESS or specific API calls) and the access of the App-Bound encryption provider symbol, which is often a target for attackers seeking to decrypt browser-stored secrets.
Detects the execution of cmstp.exe with the /au parameter, which is commonly used to install malicious INF files, when initiated by LockAppHost.exe. This pattern is often indicative of an attempt to bypass application control or achieve privilege escalation by leveraging the legitimate Microsoft Connection Manager Profile Installer.
Page 175 of 864