Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Correlates an npm, yarn, or pnpm installation of the malicious @ethersphere/bee-js version 13.3.0 package with a subsequent network connection from the same device to the known threat actor domain frameworkmetrics.xyz within a 30-minute window.
Detects a sequence where a file is dropped into a hidden .solidity directory followed by the creation of a persistence artifact (such as a systemd user unit or macOS LaunchAgent) on the same device within one hour.
KQL Query from file: PHP2Shell ThreatLock
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects cross-account AWS AssumeRole activity from an external account followed by extensive Amazon S3 enumeration and read (GetObject) operations within a 12-hour window, potentially indicating unauthorized data access or exfiltration.
Detects a sequence where an endpoint clears event logs (using wevtutil or PowerShell) and subsequently tampers with or disables security tools (such as Windows Defender or service logging) on the same device within a one-hour window.
Detects behavior where a php-fpm process spawns a command shell (sh, dash, bash) to access credential files like /etc/passwd or /etc/shadow, or invoke known renamed interpreter payloads alongside setuid/setgid patterns.
Staging data into an archive and then sending it out within a short window is a hallmark of exfiltration. Correlating the two events on the same device (archive, then a public network connection from a transfer tool within 2 hours) is much higher fidelity than either event alone. The result is summarised per archive event to avoid join row multiplication.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
KQL Query
Detects machine account NTLM logons to an Active Directory Certificate Services (AD CS) Web Enrollment server where the source device differs from the account's own host (indicative of NTLM coercion like PetitPotam), followed within 10 minutes by certificate enrollment requests (/certsrv/) from the same source host.
Detects installation of a Windows service (System EventID 7045)
named after known VirtualBox Guest Additions components (VBoxGuest, VBoxMouse, VBoxSF,
VBoxService, VBoxVideo, VBoxWDDM). Fires when either:
(a) the service binary is registered outside the legitimate VirtualBox install/driver
paths, or
(b) a driver-class component name (VBoxGuest/VBoxMouse/VBoxSF/VBoxVideo/VBoxWDDM) is
registered as a user-mode/own-process service instead of a kernel or file-system
driver — a structural mismatch that cannot occur with the genuine component and is
a strong indicator of name-based masquerading (T1036.005).
Adversaries reuse trusted VirtualBox names to blend malicious persistence into expected
guest-VM/EDR-noise telemetry.
named after known VirtualBox Guest Additions components (VBoxGuest, VBoxMouse, VBoxSF,
VBoxService, VBoxVideo, VBoxWDDM). Fires when either:
(a) the service binary is registered outside the legitimate VirtualBox install/driver
paths, or
(b) a driver-class component name (VBoxGuest/VBoxMouse/VBoxSF/VBoxVideo/VBoxWDDM) is
registered as a user-mode/own-process service instead of a kernel or file-system
driver — a structural mismatch that cannot occur with the genuine component and is
a strong indicator of name-based masquerading (T1036.005).
Adversaries reuse trusted VirtualBox names to blend malicious persistence into expected
guest-VM/EDR-noise telemetry.
Detects password spraying behavior (many accounts targeted with few failures each from the same source IP within a 1-hour window) preceded or accompanied by directory enumeration activity such as SAM-R queries, account enumeration, or LDAP queries from the same source.
Archiving then sending data out within a short window is a hallmark of exfiltration. Implemented with correlate() over three event sets: archive process → transfer-tool process → that same process's public connection, all on one aid within 2 hours.
With binaries blocked, operators upload using .NET primitives and web cmdlets (WebClient.UploadFile, Invoke-RestMethod -Method Post -InFile, FtpWebRequest). Logic is anchored on strong upload indicators, not webclient + URL (which mostly catches download cradles).
Detects the creation, modification, enabling, or removal of Microsoft Exchange transport rules. Transport rules operate at the organization level, allowing attackers with administrative privileges to create rules that redirect, copy, or delete mail across the entire organization.
The following analytic identifies the execution of suspicious processes typically associated with WebShell activity on web servers.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`.
This behavior is significant as it may indicate an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities.
If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive data.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of c2 frameworks. This activity can signify malicious actors attempting to interact with hosts on the network using known default configurations of command and control tools.
Detects 7zr.exe, 7z.exe, or 7za.exe launched by a shell process (PowerShell, Cmd) using a password extraction switch (-p) and output directory, followed within 10 minutes by the execution of a new binary from within that user-writable extraction directory.
Detects persistence mechanisms installed by the trojanized Claude Code extension on Cursor or Node-based applications. On macOS, it detects the creation of LaunchAgent property list files. On Windows, it detects scheduled tasks created via schtasks.exe or event logs, and modifications to the Startup folder.
Page 11 of 2907