Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects PowerShell execution spawning 7zr.exe to extract password-protected 7z archives using overwrite and password switches within a specified timeframe, or referencing specific malicious IOC file names and domains.
Detects instances where a browser process (Chrome, Edge, Firefox, Brave) is observed on a device shortly before an explorer.exe-initiated PowerShell, PWSH, or CMD process executes a command containing download strings or script execution patterns (such as DownloadString, Invoke-WebRequest, IEX, or encoded commands) referencing URLs.
Correlates Microsoft Teams process activity with the subsequent launch of a remote monitoring and management (RMM) tool on the same device within 30 minutes, potentially indicating social engineering or hands-on-keyboard access following external communications.
Detects a Python process spawning msiexec.exe followed by a high volume of LDAP connections (burst) from the same device within a 30-minute window, potentially indicating post-exploitation activity such as domain enumeration.
Detects Microsoft Edge (msedge.exe) spawned by command shells or script hosts with hidden or headless window parameters, or communicating with webhook.site, which is commonly indicative of malicious browser automation or exfiltration.
Detects potential SQL injection probing followed by a successful authentication response (HTTP 302) from the same external client IP within a short timeframe on IIS web servers.
Detects cmd.exe executing a ping-based delay to loopback followed by self-deletion of the batch script (%~f0), as well as bulk deletion of common archive and executable files, typically associated with malware droppers like RareWolf.
Detects PowerShell registering a logon scheduled task that executes a Trays.exe binary from an AppData Yandex Trays path with the -tray argument, or a scheduled task specifically named 'Microsoft apdate'. Associated with the RareWolf AnyDesk dropper batch script.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects outdated or vulnerable installations of GitLab and Ruby across devices using TVM software inventory, software vulnerabilities, process events, and file events, checking against known fixed versions for specific CVEs.
Detects suspicious Ghostscript execution patterns where Python spawns Ghostscript with dangerous I/O pipe arguments or disabled SAFER mode, or where Ghostscript spawns shell interpreters.
Detects the presence of Tailscale binaries (tailscale.exe, tailscaled.exe) on a device within 24 hours of other campaign-specific toolkit components such as kitanai.exe, nandemo.exe, ufw.exe, or upd-ms.bat, indicating potential unauthorized remote access setup.
Detects when a shell process (such as sh, bash, dash, cmd.exe, or powershell.exe) is spawned by a metrics, logging, or authentication management service shortly after the service accepts an inbound network connection, potentially approximating exploitation of an internal management service.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects Node-RED admin API flow deployments (POST /flows) where the payload contains an 'http in' node, a 'function' node, an 'exec' node, and 'addpay' enabled, which can indicate malicious workflow deployment or command execution attempts.
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Detects the installation or service setup of unauthorized remote access tools (such as AnyDesk, TeamViewer, or ScreenConnect) followed by outbound public network connections from the same device within a one-hour window.
Detects attempts to disable or tamper with Windows Defender settings, services, or registry keys via command-line execution (such as reg.exe, PowerShell, or sc.exe) or direct registry modifications.
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Page 15 of 1907