Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,683
9,759
6,695
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects instances of process call stack spoofing, specifically techniques like SparroWocky (hooking CreateThread to report fake start addresses such as AnimateWindow) or SilentMoonwalk (forged call stacks masking API call origins as RtlUserThreadStart or BaseThreadInitThunk) used to evade EDR behavioral monitoring.
Detects the execution of PowerShell with suspicious command-line arguments (obfuscation, hidden windows, or encoded commands) directly spawned from explorer.exe. This activity is frequently associated with malicious scripts or payloads executing in the context of user activities to evade detection.
Detects the execution of MeshAgent or mvtcs (MeshCentral) binaries, which are commonly used for legitimate remote management but can also be used as unauthorized remote access tools by adversaries.
Detects WriteProcessMemory or CreateRemoteThread operations targeting csc.exe or chrome.exe. This activity is often associated with process injection techniques used to execute code within the context of a legitimate or compiler-related process.
Detects WriteProcessMemory or CreateRemoteThread operations targeting csc.exe or chrome.exe. This activity is often associated with process injection techniques used to execute code within the context of a legitimate or compiler-related process.
Detects the use of the native Windows utility cipher.exe with the /w flag executed from the command prompt. The /w switch instructs cipher to remove data from available unused disk space, which is a technique often used by threat actors to hinder forensic recovery of deleted files.
Detects the execution of diskpart.exe using a script file (/s) launched from an atypical parent process. Diskpart is a powerful disk management utility that can be abused for staging or data destruction; invoking it via scripts from processes other than standard management shells (cmd, powershell, explorer) or services may indicate malicious activity.
Detects execution of AI coding assistants or CLI tools (such as Claude, Gemini, Copilot, etc.) that are attempting to access sensitive local configuration, credential, or authentication files, including SSH keys, AWS credentials, and browser cookies.
Detects instances where AI-assisted coding tools or command-line wrappers (e.g., Claude, Copilot, Gemini) execute Git commands (clone, checkout, fetch) involving a commit hash. This behavior may indicate automated or AI-assisted code retrieval and manipulation, which could be part of an adversary's workflow for reconnaissance or downloading malicious code repositories.
Detects instances where AI coding assistants (such as Claude, Copilot, or Gemini) are used as parent processes to execute specific git commands, including 'git rev-parse HEAD' or 'git checkout'. This can indicate automated or adversary-driven repository interaction initiated by an AI tool, potentially for source code theft, reconnaissance, or malicious automation.
Detects obfuscated PowerShell commands bypassing execution policy to download or execute 'configuration.ps1' or communicate with known malicious infrastructure associated with the ClickFix campaign. The rule specifically looks for caret-based obfuscation, bypass switches, and known IOCs in the command line.
Detects when AI-powered coding assistant plugins or CLI tools (e.g., Claude, Copilot, Gemini) execute subprocesses that attempt to access sensitive configuration files, SSH keys, or cloud credential stores. This may indicate an AI tool being manipulated or misconfigured to exfiltrate sensitive local secrets.
Detects Settra ransomware binaries characterized by naming conventions including '_win64.exe', which create 'RESTORE_FILES.txt' ransom notes and use '.locked' or '.locked_wip' file extensions for encrypted data.
Detects the execution of PowerShell or PowerShell ISE with command line arguments indicative of suspicious activity, such as the use of GZipStream for payload decompression, AesManaged for payload decryption, or in-memory assembly loading via Reflection.Assembly or EntryPoint.Invoke, often associated with fileless malware execution or obfuscated script runners.
Detects instances where WScript or CScript (Windows Script Host) initiate child processes like PowerShell or Conhost, specifically when those child processes contain command line arguments referencing environment variable access pattern 'GetEnvironmentVariable' for 'Kv' keys. This pattern is commonly associated with retrieving stored configuration or sensitive data using script-based wrappers to execute logic.
This rule detects potentially malicious behavior where common scripting processes such as PowerShell, WScript, or CScript interact with sensitive memory-related APIs (e.g., VirtualProtect, GetProcAddress, LoadLibrary) or monitor modules (amsi.dll, clr.dll). This pattern is often indicative of reflective loading, memory injection, or attempts to bypass security controls like AMSI.
Detects Ruby processes executing with arguments explicitly disabling SSL/TLS verification (OpenSSL::SSL::VERIFY_NONE) while correlating with the presence of suspicious helper scripts ('loader.rb' or 'script.rb') within Ruby gem-related directories. This behavior is indicative of an adversary attempting to perform man-in-the-middle attacks or bypass security controls for outbound C2 communications.
Detects the use of fsutil.exe to create a hardlink pointing to files within a user's AppData directory, specifically involving a folder named 'doxc'. This behavior is often associated with file manipulation to bypass security controls or masquerade malicious files.
Detects the use of cmd.exe to execute copy commands involving specific batch files (doxc.bat or config.bat) or suspicious file paths, which may indicate malicious file staging or automated data collection behavior.
Detects the use of PowerShell to perform recursive file/directory enumeration within sensitive user profile directories (Desktop, Documents, Downloads, Pictures, OneDrive) immediately followed by a network connection over port 443. This behavior is indicative of potential data staging and exfiltration activity performed by a malicious script or threat actor.
Detects the execution of Acronis backup-related processes by a non-root user while the process is running with root-level privileges (UID 0). This pattern indicates potential privilege escalation or abuse of existing backup utilities to run with elevated permissions in a context where they should not be.
Page 22 of 100