Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects Log4Shell JNDI injection attempts
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
Detects malware using excessively long sleep calls to outlast sandbox analysis time
Detects modification of domain trust relationships via LDAP for privilege escalation
Detects use of Linux extended attributes to hide malicious data
Detects RTLO Unicode character used to disguise malicious file extensions
Detects the execution of 'cmd.exe' with a command line that includes 'ping 127.0.0.1 -n 2' followed by 'del /F /Q servertool.exe'. This sequence suggests an attempt to delay and then forcefully delete a file named 'servertool.exe', which could be indicative of malware self-deletion or an attacker cleaning up traces.
Detects broad assignments of administrative roles or specific deletion permissions for cloud storage buckets in GCP, AWS, and Azure. This includes granting 'storage.admin', 'storage.objectAdmin', or 'storage.buckets.delete' in GCP, 's3:DeleteBucket' in AWS IAM policies, or 'Storage Account Contributor'/'Owner' roles in Azure. Such assignments to service accounts or non-administrative identities could enable 'Universal Bucket Hijacking' or unauthorized data deletion.
Detects processes exhibiting behaviors indicative of process injection, such as suspicious binary names, command-line arguments related to spawning sleep processes, or ptrace system calls. This rule identifies potential attempts to inject malicious code into other processes to evade defenses or elevate privileges.
Detects the execution of 'cmd.exe' with a command line that includes 'ping 127.0.0.1' combined with a file deletion command ('del', 'delete', 'erase'). This pattern is often used by malware, such as ransomware, to introduce a delay before self-deletion or to ensure network connectivity before performing destructive actions, followed by an attempt to remove its traces.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. This rule specifically looks for the combination of '-bxor[int][char]$' and '[convert]::ToInt32' within PowerShell command or script block execution events, which is characteristic of the ErrTraffic ClickFix malware distribution framework.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.
Detects when a known OpenClaw AI agent process spawns a shell to download and immediately execute a script. This is a common pattern used by malicious "Skills" to establish persistence or run further payloads, as detailed in the NSFOCUS report.
Identifies the creation of named pipes matching standard Cobalt Strike malleable C2 profiles (\pipe\msagent, \pipe\postex, \pipe\status, \pipe\spoolss) that are associated with network activity, indicating advanced C2 deployment.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Detects the execution of 'opsec_enum.sh', a post-exploitation cleanup script, and associated activity involving ZipSlip-based webshell persistence components (such as 'mkzip34.py' and specific chunked file names) used by the threat actor MexicanMafia during Operation Escaneo.
Detects LCRYX ransomware performing UAC bypass by utilizing VBScript to spawn a new wscript.exe process with elevated privileges. The rule monitors for WScript or CScript processes spawning another WScript process where the command line contains the '/elevated' flag, indicating the use of the Shell.Application object's ShellExecute method with the 'runas' verb.
Detects attempts to bypass User Account Control (UAC) by spawning processes from fodhelper.exe, eventvwr.exe, or computerdefaults.exe. These executables are known to be vulnerable to UAC bypass techniques, allowing an attacker to elevate privileges without user interaction.
Detects a browser creating a ZIP archive whose name impersonates a GPU, disk, temperature, codec, or PDF utility associated with high-performance systems. This activity is often associated with poisoned search results leading to cryptojacking campaigns.
This rule detects activities associated with the DRAYN malware, specifically the unauthorized modification of Discretionary Access Control Lists (DACLs) on MSP management platform directory archives using icacls, followed by the creation of a scheduled task to establish persistence.
Detects attempts by scripts (spawned via wscript.exe, cscript.exe, or powershell.exe) to disable or interfere with security products. This includes disabling Microsoft Defender via registry modifications or PowerShell commands, disabling the Windows Firewall using netsh, and terminating or stopping security software processes and services using taskkill, sc, or net.
Page 323 of 864