Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the use of tasklist.exe combined with process filtering (findstr) to identify common debugger names such as 'dbg.exe', 'x64dbg.exe', 'windbg.exe', or 'ollydbg.exe'. This technique is a known evasion tactic employed by the Kimsuky threat group (and others) to check for the presence of analysis tools before continuing execution of malicious batch scripts.
Detects unauthorized access to common browser credential and cookie files by processes other than standard web browsers. This activity is a common indicator of credential harvesting malware or unauthorized data collection.
Detects the execution of mshta.exe with command-line arguments that reference VLC-themed filenames or presentations. This behavior is indicative of a malicious HTA file being used as a lure to drop the Lightlife RAT loader, leveraging the mshta.exe utility to bypass standard application execution controls.
Detects the execution of PowerShell with a combination of flags commonly used to hide malicious activity: -NoProfile, -WindowStyle Hidden, and -EncodedCommand. This combination is frequently used by adversaries to execute obfuscated code silently, bypassing user visibility and script analysis.
Detects the execution of the Lightlife RAT via a PowerShell script named 'lightlife.ps1'. The rule monitors for processes running from the LOCALAPPDATA directory, the use of PowerShell with execution policy bypass and hidden window style, or execution triggered via common scripting hosts like wscript.exe or mshta.exe combined with PowerShell download cmdlets.
Detects potential path traversal or unauthorized access attempts by Semantic Kernel Agents (or related processes like Python/DotNet) to sensitive host files. The rule monitors for file read, creation, or modification activities targeting sensitive credentials, configuration files (e.g., .ssh, .aws, .kube), and system files, which could indicate a sandbox escape or malicious data collection.
Detects exploit attempts targeting a Python prompt-injection vulnerability (CVE-2026-26030). The rule identifies command lines attempting to traverse Python's object hierarchy (e.g., using __class__, __base__, __subclasses__) to import the os module and execute system commands. It also flags subsequent child processes (e.g., calc.exe, cmd.exe) spawned by Python interpreters or Semantic Kernel host processes.
This rule identifies non-browser processes (and those not originating from standard installation directories of common browsers) that exhibit persistent, repeated network connections to the OpenAI API. This pattern is indicative of potential C2 traffic, where adversaries abuse the OpenAI Assistants API as a covert communication channel (e.g., SesameOp).
Detects outbound HTTP GET requests containing a .ps1 file extension in the URI, originating from a host without a specified User-Agent, and targeting domains other than Microsoft or Windows Update. This pattern is characteristic of a persistence mechanism executing a PowerShell script to download a secondary payload (e.g., via Net.WebClient).
Detects instances where browser automation tools (e.g., Selenium, Puppeteer, Playwright) or headless browser instances initiate command-line interpreters or scripting hosts. This behavior is indicative of potential automated exploitation, such as browser-based attacks where a malicious script attempts to execute commands directly on the host operating system.
This rule detects scenarios where a browser or agent process downloads a file and subsequently initiates a local process that references the downloaded file within a very short timeframe (2 minutes). This pattern is indicative of automated or agentic behavior (such as AI-assisted malware execution) where a download is followed by immediate, non-human-mediated execution of the downloaded content.
This rule detects potential AI agent prompt injection by monitoring email subjects or attachment names for keywords often associated with system instruction overrides. It correlates these potentially malicious emails with subsequent execution of common administrative or script-interpreting binaries (e.g., PowerShell, cmd.exe) on the recipient's device within a one-hour window, suggesting a potential successful hijack of an automated process or AI agent.
Detects high-volume outbound network scanning activity from a single compute resource, characterized by a significant number of distinct destination IP addresses and ports within a short timeframe. This behavior is indicative of automated service discovery and reconnaissance, often associated with adversary-orchestrated exploitation pipelines or botnet activity.
Detects unauthorized processes (non-browser) reading sensitive browser session and credential files (e.g., Cookies, Login Data) across multiple user profiles, followed by immediate outbound network connections. This behavior is highly characteristic of commodity information stealers (e.g., LummaC2, Stealc, Vidar) attempting to exfiltrate browser-stored credentials and session data.
Detects network connections from common web browsers to domains associated with the BragJack threat actor infrastructure. This activity potentially indicates an end-user accessing malicious sites used for credential harvesting, malware delivery, or C2 communication.
Detects instances where a Semantic Kernel agent host process (or related .NET processes) spawns suspicious child processes such as command shells, network tools, or system enumeration utilities. This activity is indicative of potential command injection or remote code execution via AI agent frameworks, where an LLM-driven agent might be coerced into executing arbitrary commands on the underlying host.
Detects the invocation of file-related functions (DownloadFileAsync, upload_file) within the Semantic Kernel framework that lack associated validation function calls. This pattern is indicative of potential Remote Code Execution (RCE) or unauthorized file system access scenarios where an LLM agent is coerced into performing dangerous file operations without path sanitization.
Detects instances where a Semantic Kernel AI agent, running via Python or .NET, accesses sensitive local files like SSH keys, cloud credentials, or environment files immediately before triggering a potential file upload operation.
Detects instances where an AI agent (e.g., Semantic Kernel) launches command-line tools commonly used to perform bulk data destruction or system wiping, such as file deletion commands, volume shadow copy removal, or disk formatting. This rule flags suspicious orchestration by AI agents that may be acting outside of expected parameters.
Detects attempts to bypass input sanitization in AI agent frameworks, specifically Semantic Kernel, by using Python bracket or subscript notation to access sensitive attributes or functions (e.g., __class__, __subclasses__, __import__, eval, exec). This technique is characteristic of filter injection attacks aiming to achieve remote code execution in AI agent environments.
Detects instances where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command-line utility or scripting engine (e.g., PowerShell, WScript, Cmd) to execute a file located within common download or temporary directories. This behavior is a common indicator of a user executing a malicious file downloaded from the internet.
Page 241 of 1908