Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects observable hiding actions targeting ScreenConnect (ConnectWise Control) clients, such as modifying registry keys to hide uninstall entries, using attrib.exe to set hidden attributes, or launching management tools with hidden window styles.
Detects PowerShell being launched directly from the Windows Run dialog
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
Detects a web browser spawning a script interpreter or dual-use
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
Detects attempts to inhibit system recovery by stopping the Volume Shadow Copy Service (VSS) using utilities like net, net1, or sc, or deleting shadow copies using vssadmin.exe, excluding known backup agents.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects web server processes (such as apache2, nginx, httpd, php-fpm, or w3wp.exe) spawning shell interpreters (such as bash, sh, cmd.exe, or powershell.exe), which is a common indicator of web shell activity or application exploitation.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Detects instances where a web browser accesses a domain listed in the 'AdFection_Domains' watchlist, followed closely by the browser spawning a script interpreter (such as PowerShell, wscript, cscript, mshta) or dropping an executable/script file in user profile or temporary directories.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.
Detects modification or creation of .htaccess files within WordPress directory structures followed within 24 hours by the creation or modification of .cache files in the same directory. This behavioral pattern is often indicative of web shell deployment or persistence installation via compromised web applications.
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Detects instances where inst.exe running from C:\ProgramData\Intel with specific command-line arguments (extensionless and key-like) subsequently writes files to the EFI system partition or boot paths on the same device.
Detects the creation of a scheduled task named ChromeUpdate with highest privileges on logon, initiated from a process running within the user AppData\Local\Temp directory.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects NTDSUtil commands associated with Active Directory database export, installation media preparation, and snapshot creation, which may facilitate offline credential extraction.
Correlates internet-origin executable creation with subsequent execution by Windows shell processes using matching device, file path and SHA1 hash within a five-minute timeframe.
The following analytic detects the use of the taskkill command in a process command line to terminate several known browser processes, a technique commonly employed by the Braodo stealer malware to steal credentials. By forcefully closing browsers like Chrome, Edge, and Firefox, the malware can unlock files that store sensitive information, such as passwords and login data. This detection focuses on identifying taskkill commands targeting these browsers, signaling malicious intent. Early detection allows security teams to investigate and prevent further credential theft and system compromise.
Detects web server processes writing PHP files into sensitive WordPress directories (such as mu-plugins or rank-math-pro/includes) shortly after deleting them within a 1-hour window. This behavior often indicates the rebuilding or updating of a webshell or backdoor for persistence.
Page 19 of 1907