Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects a Node.js web server process initiating a child process that is a known command shell or download utility, which is indicative of post-exploitation activity such as remote code execution.
Detects the installation or execution of unauthorized Remote Monitoring and Management (RMM) tools such as MeshCentral, Atera, Teramind, AnyDesk, or AdaptixC2 artifacts on endpoints. It flags devices running multiple distinct RMM tools or featuring AdaptixC2.
Identifies Node.js processes that spawn potentially suspicious child processes, including operating system shells, command interpreters, scripting runtimes, and download utilities. This behaviour may indicate exploitation of a Node.js application resulting in arbitrary command execution, followed by payload retrieval or additional post-exploitation activity.
Detects the Tensorlake npm compromise (tensorlake@0.5.144, Shai-Hulud) through the two payload hashes, gh-token-monitor persistence, node or bun running lib/setup.mjs or Math_Symbol.js and node or bun connections to iseekaigogo.com or public Ethereum RPC hosts. It needs Defender for Endpoint events from developer machines and does not see lockfile or package cache contents. The query ran without errors in a live tenant
Detects web servers, PHP processes, or shell processes spawning fetch utilities such as wget or curl to communicate with a specific malicious payload IP address (162.35.99.94), often indicative of web shell exploitation or post-exploitation file download activity.
Detects a Node.js or Bun process spawning a shell or common download utility on Linux, indicating potential post-exploitation activity such as remote code execution (e.g., CVE-2026-111497).
Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.
Detects command-line execution of script interpreters (PowerShell, CMD, MSHTA) spawned via Windows Explorer containing download primitives and URLs, followed by immediate external network connections.
Detects process creation of known C2 and tunneling tools associated with INC and The Gentlemen ransomware affiliates, including Sliver, RevSocks, Ghost C2, Athena, QuickLine, and Phantom, by matching image names, original file names, or command-line arguments.
Detects the sequence where a private key file is written to the host followed by the execution of ssh.exe with parameters indicating a reverse port forwarding tunnel (-R), an identity file (-i), and background execution (-N or -f) within a 30-minute window.
Detects instances where a browser process (Chrome, Edge, Firefox, Brave) is observed on a device shortly before an explorer.exe-initiated PowerShell, PWSH, or CMD process executes a command containing download strings or script execution patterns (such as DownloadString, Invoke-WebRequest, IEX, or encoded commands) referencing URLs.
Detects network connections and requests to specialsseason.com, an IOC associated with the Huntress php2shell advisory.
Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.
Detects the installation or service setup of unauthorized remote access tools (such as AnyDesk, TeamViewer, or ScreenConnect) followed by outbound public network connections from the same device within a one-hour window.
Detects potential C2 beaconing activity associated with Potassium by correlating a DNS query for a known C2 domain with a subsequent TCP connection to port 50792 from the same device within a short time window.
Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.
Detects process command lines containing Magento database audit strings (cms_block, cms_page) alongside specific loader domains, or network events communicating with these known loader domains.
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects the execution of tooling routed through a reverse SOCKS5 pivot via wrappers such as via_socks.sh, proxychains4 with a SOCKS5 configuration, or LD_PRELOAD injection of libproxychains.so.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Page 1 of 296