Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects potential reflective DLL injection or process hollowing attempts by monitoring for high-privilege cross-process access (ProcessAccess EventID 10) or remote thread creation (CreateRemoteThread EventID 8). These methods are frequently used by attackers to execute malicious code within the memory space of a legitimate target process, thereby evading traditional signature-based detection.
Detects potential 'ClickFix' activity where a browser or file explorer process initiates a shell (e.g., cmd, powershell, osascript) with command arguments indicative of remote script execution, obfuscated commands, or web-based payload downloading. This pattern matches known social engineering tactics that entice users to copy-paste malicious code into a system shell.
Detects usage of the Rclone utility (or renamed binaries) to transfer data to various cloud storage backends (S3, Mega, pCloud, SFTP, WebDAV). The detection correlates this activity with the execution of common archival tools (7-Zip, WinRAR, TAR) within one hour prior to the data transfer, which is a common behavior of adversaries preparing data for exfiltration.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects attempts to dump the Local Security Authority Subsystem Service (LSASS) process memory for credential harvesting. The rule monitors for unauthorized process access requests (e.g., PROCESS_VM_READ), suspicious file creation of memory dumps in common writeable directories, and command-line execution of tools or techniques commonly associated with LSASS dumping (e.g., Mimikatz, procdump, or abusing comsvcs.dll).
Detects the abuse of the Windows built-in utility 'certutil.exe' to download files from remote locations using the 'urlcache', 'verify', or 'verifyctl' arguments. Attackers often leverage this LOLBIN to download malicious payloads as it is a trusted system binary.
Detects attempts to inhibit system recovery by deleting Volume Shadow Copies or modifying Windows Boot Configuration Data, a technique commonly employed by LockBit and other ransomware families prior to file encryption.
Detects msiexec.exe spawned from explorer.exe, consistent with a user double-clicking a malicious .lnk shortcut, where the command line triggers the installation of an MSI package hosted on a remote HTTP/HTTPS server. This behavior is a known initial access technique used by FIN7 to deliver malicious payloads.
Detects command-line indicators associated with destructive disk-wiping activity, specifically targeting disk structure corruption to render systems unbootable. This rule monitors for unauthorized use of the Windows 'diskpart' utility, direct raw physical drive access, and specific file system utility commands (fsutil) frequently observed in wipers attributed to APT44 (Sandworm).
Detects potential ransomware activity characterized by the mass renaming of files with specific extensions (.locked, .locked_wip) or the creation of known ransomware note filenames (RESTORE_FILES.txt) on a Windows system.
Detects the installation and execution of MeshAgent, a remote monitoring and management (RMM) tool, by identifying specific command-line arguments, service names, and renamed binary execution. Adversaries often use RMM tools for persistent remote access and command and control.
Detects instances where AI agent runtime processes (e.g., Python, Node.js) initiate child processes using common Windows Living-off-the-Land Binaries (LOLBAS). This behavior may indicate an AI agent has been compromised or misused to execute unauthorized system commands for defense evasion or post-exploitation activities.
This rule detects unauthorized or anomalous outbound network connections from known AI agent runtime processes to LLM or API endpoints. It helps identify potential data exfiltration by monitoring for connections to destinations outside of an organization's approved allow-list for model providers, effectively catching scenarios where a compromised AI agent is prompted to relay sensitive data to an attacker-controlled endpoint.
Detects the abuse of the CMSTPLUA COM object, a known technique for UAC bypass, to execute a hidden and non-profile PowerShell process. This behavior is associated with malicious activity chains like RemotePanel or BoundSiphon that aim to achieve elevated execution.
Detects unauthorized processes attempting to read sensitive wallet extension storage files or desktop application wallet data folders, a behavior characteristic of the Psychedelic Stealer malware designed to harvest cryptocurrency credentials prior to exfiltration.
Detects the execution of taskkill.exe to terminate known security software processes, when the command is initiated from sqlservr.exe or via a command shell child process of sqlservr.exe. This activity is a common post-exploitation step after abusing xp_cmdshell to neutralize defenses before deploying further payloads.
Detects the execution of the encryptbase64.ps1 PowerShell script when invoked by a process other than PowerShell or PowerShell Core. This behavior is indicative of NeedyMantis malware attempting to evade detection by executing scripts outside standard script hosts.
Detects instances where a Python process spawns a command-line shell (cmd.exe, powershell.exe, or bash) within 15 seconds of starting, while executing common reconnaissance or utility commands. This behavior is indicative of malicious code executing at import-time, a technique often associated with supply chain compromises in Python packages.
This rule detects potential persistence via Python environment variable manipulation (PYTHONPATH) followed by suspicious network activity from a child process of python.exe. It specifically looks for the modification of the PYTHONPATH environment variable using PowerShell on Windows or shell configuration files on Unix-like systems, followed by a python.exe-initiated network connection (like curl) to external domains, which may indicate the execution of a malicious sitecustomize.py hook.
Detects the execution of 'sqlcmd.exe' when spawned by web application pools (w3wp.exe) or general command shell (cmd.exe) processes that do not appear to be related to authorized database administration or IIS appcmd activity.
Detects the use of 'findstr' or PowerShell to query sensitive configuration files (such as web.config or applicationHost.config) for credential-related keywords like 'connectionString', 'AccountKey', or 'machineKey'. This behavior is indicative of an adversary attempting to harvest credentials or sensitive configuration data stored in cleartext on the filesystem.
Page 22 of 465