Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the clearing of the Windows Security Event Log. This activity is a common indicator of an adversary attempting to remove evidence of their presence or actions on a compromised host.
Detects instances where a process named 'updater.exe' launches another process also named 'updater.exe'. This pattern can indicate suspicious activity where a legitimate updater process is being misused or abused to spawn additional malicious code or side-load components.
This rule detects the presence of a 7-Zip library file ('7z.dll') located within a specific 'Traiolx Custom Utils' directory. The rule flags this file based on known malicious file hashes (MD5 or SHA256) or its specific file path. This is indicative of an adversary placing custom or potentially malicious tools on a system for archive manipulation or data staging.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to modify the 'amsiInitFailed' field within the 'AmsiUtils' class. This technique is commonly used by malicious scripts to disable AMSI scanning during their execution.
Detects suspicious PowerShell command lines that utilize both 'Invoke-Expression' (iex) and 'Invoke-RestMethod' (irm), often used to download and execute code directly from remote sources. The rule specifically monitors for known indicators like specific IP addresses, file paths, or the concurrent use of these cmdlets in a single command line.
This rule detects the presence of compiled Python 3.10 bytecode (.pyc) files that have been renamed to or disguised with a .cat extension. It specifically looks for the 'settingenv.cat' file associated with the Chinotto backdoor, as well as associated C2 URL patterns or command-line artifacts indicative of its download and execution chain.
Detects the creation of scheduled tasks using schtasks.exe that are configured to run every minute, specifically targeting command lines associated with known suspicious processes like 'codeflush.exe' or potentially masqueraded music library tasks.
Detects Python processes (python.exe, python3.exe, pythonw.exe) loading native library files (.pyd or .so) followed by file access to sensitive browser credential and cookie storage locations (e.g., Login Data, Cookies, Local State). This pattern is characteristic of infostealer activity, where a Python script uses a native module to decrypt or extract browser-stored credentials.
Detects Hancom HWP documents that contain an OLE BIN0001.OLE stream and specific JScript storage structures, which are indicative of a weaponized document used to execute scripts and fetch remote payloads from a specific command-and-control URL.
Detects the creation of a shortcut (.lnk) file within the Windows startup folder using PowerShell. The rule monitors for PowerShell processes executing commands to create .lnk files (e.g., via WScript.Shell) or directly monitors file creation events targeting the startup directory. This behavior is indicative of malicious persistence mechanisms.
Detects the addition of exclusion paths to Microsoft Defender via PowerShell (Add-MpPreference or Set-MpPreference) initiated by non-Microsoft signed processes or specific messaging applications. This behavior is often indicative of malware attempting to exclude malicious payloads from security scanning.
Detects Microsoft Edge executable (msedge.exe) being created, deleted, or renamed within the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This path is often used by adversaries to masquerade malicious files or persistence mechanisms as legitimate telemetry components.
This rule detects unauthorized processes attempting to access 'Login Data' files associated with Google Chrome or Microsoft Edge web browsers. Legitimate browser processes are excluded, so any external process attempting to read these files is potentially malicious, indicating an attempt to dump stored browser credentials.
This rule detects the execution of cmd.exe with a command line containing both '/k' and 'Set' commands, alongside a regex pattern that searches for specific variable expansion techniques ('%var:~offset,length%'). This pattern is frequently used to obfuscate command lines or bypass static security signatures by reconstructing strings at runtime, often in conjunction with PowerShell commands.
This rule monitors for the creation of files with the .ent extension within the Microsoft Internet Explorer directory. The rule specifically looks for files with a six-character alphanumeric name (e.g., abc123.ent), which may indicate the use of custom scripts, configuration files, or data staging by potentially malicious actors leveraging the browser's directory structure for persistence or data storage.
Detects instances where a GitLab runner process (gitlab-runner.exe) spawns a PowerShell process with arguments typically used to execute scripts while bypassing security restrictions, such as -NoProfile, -NonInteractive, -ExecutionPolicy, and Bypass. This pattern is indicative of automated task execution or potential abuse if the runner environment is compromised.
This rule detects the execution of specific suspicious batch scripts (e.g., 'bd_test_k7old.bat') via cmd.exe, or the creation of a Windows service involving kernel drivers using sc.exe, which may indicate testing of defensive mechanisms or the deployment of potentially malicious kernel-level components.
Detects instances where the Cursor IDE (or associated helper processes) spawns a child process or executes a command involving a specific 'DevOps-Automation/cloudshield' path. This monitors for potential abuse of IDE environments to trigger sensitive automation scripts, possibly indicating malicious use of IDE tooling or unauthorized development activities.
Detects signs of malicious activity involving specific files (StreamServiceSharedBridge.ps1, ComponentTask33Agent) and behaviors, including PowerShell execution, scheduled task creation, script execution via wscript, and registry run key modification. These behaviors are indicative of persistence mechanisms and potentially suspicious command execution.
Detects the use of PowerShell to delete .js files located within the 'Downloads' directory. This behavior is commonly associated with cleanup of dropped malicious payloads or script-based malware artifacts.
Detects suspicious PowerShell command lines indicative of process termination or abnormal enumeration of .NET Framework process directories via WMI. This includes using Stop-Process against specific proxy execution binaries or using Get-CimInstance to inspect sensitive .NET framework directory structures, which may be associated with process hollowing or security product interference.
Page 255 of 1908