Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects a coordinated attack sequence where a browser process is terminated, followed immediately by the execution of an unsigned Python interpreter from a suspicious location (temp/downloads folder), which is then followed by the installation of an unsigned browser extension. This pattern mimics ClickFix and browser-based RAT lure campaigns.
Detects an attempt to exploit a quote-injection vulnerability within the SharePoint ToolPane.aspx page, specifically targeting the Register directive to bypass SafeControls restrictions. This pattern is commonly used for remote code execution or unauthorized application behavior modifications by manipulating server-side parsing.
Detects a single account requesting an abnormally high number of distinct Kerberos TGS (Ticket Granting Service) tickets for SPN-mapped accounts within a 15-minute window. This behavior is indicative of Kerberoasting, where an attacker requests service tickets to perform offline brute-force cracking of service account passwords, often used for lateral movement.
Detects signs of Zerologon (CVE-2020-1472) exploitation by correlating Netlogon (MS-NRPC) authentication anomalies involving known exploitation tools/process names with subsequent machine-account password reset events (Event ID 4742) occurring on the same device within a short time window.
Detects a multi-stage process execution chain beginning with common end-user applications (browsers, Office apps, explorer.exe) spawning known LOLBins (Living-off-the-Land Binaries), which in turn execute secondary LOLBins with suspicious command-line indicators. This pattern often signifies post-exploitation activity such as secondary payload delivery, fileless malware execution, or proxy execution of malicious scripts/commands, consistent with ClickFix or BYOVD-related ingress techniques.
This rule detects potential 'ClickFix' phishing activity where a user is tricked into executing malicious commands in a Windows shell. The rule looks for browser or file explorer processes acting as the parent process to command-line interpreters (cmd.exe, powershell.exe, etc.) executing suspicious command-line arguments often used to fetch or run malicious scripts from the internet.
Detects anomalous child process execution from SharePoint's w3wp.exe worker process following the loading of suspicious .NET assemblies (PresentationFramework.dll, System.Xaml.dll, System.Data.Services.dll). This behavior is indicative of a post-exploitation stage for SharePoint SafeControls bypass vulnerabilities, where a gadget chain is utilized to execute unmanaged or child processes.
Detects the 'ClickFix' social engineering attack where a user is instructed to use the Windows Run dialog (Win+R) to execute a malicious one-liner. This activity is characterized by explorer.exe spawning common command/script interpreters (powershell, cmd, mshta, etc.) containing typical download-and-execute strings (cradles), which bypasses browser-based download security controls.
Detects the use of PowerShell script blocks that attempt to bypass or disable Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) by interacting with internal .NET objects or DLLs, a common technique in phishing-delivered payloads.
Detects mshta.exe or rundll32.exe spawned as a direct child of explorer.exe with a remote HTTP/HTTPS URL or javascript: URI as an argument. This pattern is indicative of ClickFix-style phishing campaigns where users are socially engineered into running malicious commands via the Windows Run dialog or clipboard, leading to execution of remote malicious payloads proxied through trusted system binaries.
Detects the execution of Python interpreters from user-writable directories (Temp, Downloads, AppData) when launched by common LOLBins or shell-like parents, which is indicative of the CastleLoader 'ClickFix' phishing chain where attackers deploy a portable Python runtime to execute malicious payloads.
Detects the execution of NetSupport Remote Access Tool (RAT) components (client32.exe, Nskbfltr.sys, or TCCTL32.dll) from locations outside of the standard program installation directories. This behavior is often indicative of unauthorized persistence or masquerading by malware utilizing remote support software for C2.
Detects the creation of files on disk by a browser process where the Zone.Identifier metadata indicates the origin was a blob:, data:, or about:blank URI. This behavior is indicative of HTML smuggling, where malicious payloads are reconstructed client-side from within an HTML document, bypassing network-based security controls.
Detects the execution of programs directly from the root of a removable or virtual drive (e.g., ISO, IMG, VHD) via explorer.exe. This activity is a hallmark of phishing attacks that leverage container mounting to bypass Mark-of-the-Web (MOTW) security protections, as files extracted from or executed within mounted containers often fail to inherit MOTW metadata.
Detects the use of pcalua.exe to launch executables or scripts located in potentially transient or user-writable directories such as Temp, Downloads, or AppData. This behavior is indicative of an adversary attempting to execute payloads while bypassing security controls or masquerading as legitimate system processes.
Detects a chained sequence of suspicious activity initiated by agentic AI development tools (e.g., Claude Code, Aider, AutoGen). The rule identifies the execution of these tools followed by local reconnaissance commands, lateral movement attempts, and outbound network connections originating from the same host, indicating potential automated exploitation or credential abuse.
This rule detects potentially suspicious activity involving conhost.exe, a process typically associated with console applications. It identifies conhost.exe instances running from suspicious paths (e.g., Temp, Downloads, AppData) or launched by unexpected parent processes. Additionally, it detects scenarios where conhost.exe acts as the parent process to common command-line or scripting utilities, which is an atypical behavior often indicative of an attempt to obscure malicious command execution.
Detects command-line execution patterns that exhibit hallmark traits of LLM-generated code, such as overly verbose and explanatory comments, appearing alongside common obfuscation or decoding primitives (e.g., base64, iex, eval). This combination suggests the use of AI to assist in creating decoy logic or burying malicious payloads within legitimate-appearing scripts to evade detection.
Detects a chained sequence of suspicious activity initiated by agentic AI development tools (e.g., Claude Code, Aider, AutoGen). The rule identifies the execution of these tools followed by local reconnaissance commands, lateral movement attempts, and outbound network connections originating from the same host, indicating potential automated exploitation or credential abuse.
Detects endpoint behavior consistent with AI-assisted exploit development, characterized by the execution of reverse engineering and vulnerability research tools (e.g., IDA Pro, Ghidra, AFL) interleaved with frequent outbound network connections to LLM APIs, followed by the local compilation of a new executable or DLL.
This rule detects a malicious execution sequence often associated with VBScript droppers. It identifies the execution of a process (specifically notepad++.exe) from a dynamically named staging directory under C:\Users\Public\, followed within 10 minutes by the deletion of the associated staging archive (Evernote.zip).
Page 174 of 1908