Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects a single host performing a high volume of connection attempts to internal IP addresses across standard management and file-sharing ports (SMB 445, RDP 3389, WinRM 5985) within a 5-minute window. Such behavior is characteristic of network scanning or reconnaissance activities performed by adversaries attempting to identify targets for lateral movement.
Detects persistence mechanisms used by The Gentlemen ransomware, specifically the creation of malicious scheduled tasks (UpdateUser, UpdateSystem, or gentlemen_system) and modification of registry Run keys (GupdateS or GupdateU). The rule also monitors for the presence of the operator password string 'G7Vz9eyG' within command line arguments.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
Detects reconnaissance and persistence behaviors associated with the Akira ransomware attack chain, specifically the execution of the Cloudflare Tunnel daemon for remote access or the creation/modification of local user accounts via standard Windows tools.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects anomalous behavioral patterns where an AI agent process (e.g., Claude Code, Cursor, Aider) performs multi-category discovery of its own runtime environment, plugins, and host configuration. The rule identifies agents that trigger processes spanning at least three distinct discovery categories (Network, File/Plugin, Software, or System) within a short timeframe, indicating potential reconnaissance of agent-authorized capabilities and tools rather than standard host exploration. Covers T1082, T1518, T1083, T1016
Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.
Detects the execution of PowerShell from web browser parent processes (chrome, edge, firefox, iexplore) using obfuscation techniques (hidden window, encoded command, no profile) combined with an indicator of WebDAV access (DavWWWRoot), which is commonly used to execute payloads from remote network shares.
Detects extension code implementing Caesar-shift-over-base64 decoding of a remote proxy server list fetched from dead-drop hosts, feeding a PAC-based proxy configuration
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
This rule detects the use of 'mshta.exe' to execute HTML (.html, .htm) or MHTML (.mhtml, .mht) files. This behavior is often associated with bypassing Mark-of-the-Web (MotW) protections, as attackers may use container formats to deliver files that do not properly inherit MotW markings when extracted, allowing them to be opened by 'mshta.exe' without restrictive security policies.
Detects execution of a renamed Python interpreter (python.exe, ipy.exe, ipy64.exe) from suspicious locations (e.g., Temp, Downloads) or when launched by common web browsers and shell processes. This behavior is indicative of an adversary attempting to execute malicious scripts while masquerading as a legitimate process to evade detection.
Detects suspicious commands or script-based execution strings being inserted into the Windows Explorer 'TypedPaths' registry key. This registry key stores the history of paths entered into the Windows Explorer address bar, and attackers can abuse this mechanism to execute arbitrary commands by pasting malicious strings that are then interpreted or executed by the shell.
FileFix (mr.d0x, June 2025) tricks victims into pasting a clipboard payload into the File Explorer address bar; explorer.exe directly spawns the hidden shell command with no legitimate GUI file-open lineage.
FileFix execution via the Explorer address bar writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths, a forensic artifact distinct from the Run dialog's RunMRU key, immediately before the malicious child process spawns.
FileFix lures append a real-looking file path after a '#' comment character so the Explorer address bar visually shows a benign path while the PowerShell prefix executes silently.
The FileFix→StealC payload chain (Facebook-security-alert lure, Acronis/HivePro 2026 reporting) harvests browser-stored credentials, cookies, and session data as its primary objective.
The FileFix→StealC payload chain (Facebook-security-alert lure, Acronis/HivePro 2026 reporting) harvests browser-stored credentials, cookies, and session data as its primary objective.
Once a FileFix chain succeeds, StealC and related loaders commonly establish Run/RunOnce persistence to survive reboot shortly after or before exfiltration.
Acronis TRU (Sept 2025) documented a FileFix campaign where a PowerShell loader downloads images from Bitbucket that conceal embedded malicious components, ultimately deploying a Go-based loader and StealC.
The FileFix StealC campaign's final-stage loader is written in Go and performs VM/sandbox checks plus string encryption before executing the infostealer.
Page 137 of 1908