Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,022 detections
Filters
Last updated
All Time
Detection languages
23,931
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,580
11,924
5,908
5,189
4,871
Platforms
40,137
7,364
6,547
3,913
3,687
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
18,173
15,727
12,654
8,468
6,288
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects instances where Setup.exe loads the winmm.dll module from the same non-system directory located in user-writable paths (such as Users, Downloads, AppData, Temp, or ProgramData), which is indicative of DLL hijacking or side-loading activity.
Detects the deployment of the ARTEX AI penetration testing framework via Docker/Docker-compose combined with the execution of offensive security and scanning tools (such as nmap, sqlmap, nuclei, httpx, apktool, frida) on the same host within a specified timeframe.
Detects usage of system utilities to discover system network connections
Detects disabling Windows Defender Exploit Guard Network Protection
Detects process command lines referencing browser credential
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
Detects the correlation of a file creation event in the user Temp folder (such as t.vbs) originating from browser cache or download patterns, followed shortly by the execution of the script via wscript.exe or cscript.exe.
Detects a sequence where a Codex agent process executes a shell or command interpreter, followed by logging or monitoring tampering activity on the same device within a 30-minute window.
This detection identifies potentially algorithmically generated domains (DGA) observed in Trend IA XDR telemetry. DGA domains are commonly used by malware families for Command and Control (C2) communications because they generate large numbers of pseudo-random domain names, making blocking and takedown efforts more difficult.
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
Detects a PHP-FPM child process crashing with signal 11 (SIGSEGV) as logged by the FPM master, which may indicate exploitation attempts following an arm-shaped request. Correlate with the arm fatal error by timestamp and source. Note - the logsource product linux / service php-fpm is not defined by SigmaHQ. Map it with a processing pipeline to the PHP-FPM master log (for example /var/log/php8.x-fpm.log on Debian/Ubuntu, /var/log/php-fpm/error.log on RHEL-family, container stderr for official php-fpm images, or the php-fpm systemd journal unit).
Detects HTTP POST requests with multipart form data containing PHP session identifiers and PHP session upload progress parameters, indicative of an exploit attempt against a PHP application vulnerability (CVE-2026-109619).
Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.
Detects Microsoft 365 session token replay as described in the Huntress token spray research: sign-ins from the campaign addresses, scripted clients (node or a bare Mozilla/5.0 user agent) using the Office, Authentication Broker or OfficeHome app IDs from an address new to the account, Device Registration Service access from a new address and one session seen from different operating systems and addresses. The campaign address list is short lived and serves as enrichment.
Detects execution of a specific PowerShell remediation script using execution policy bypass, or generic PowerShell activity importing certificates into the LocalMachine\Disallowed store outside of known administrator processes and accounts.
The following analytic detects taskkill.exe being launched with a process ID (/pid) argument by an executable that resides directly within
a user profile folder, such as the Downloads or Desktop folder. Filtering for parent processes located two to three directory levels deep
under root folder. This activity is significant because browser hijackers and adware droppers executed from the Downloads folder forcefully
terminate the running browser by PID so that they can modify its profile and relaunch it with their own settings. If confirmed malicious, this
could allow an attacker to tamper with browser preference files, side-load extensions and redirect the victim's browsing traffic.
a user profile folder, such as the Downloads or Desktop folder. Filtering for parent processes located two to three directory levels deep
under root folder. This activity is significant because browser hijackers and adware droppers executed from the Downloads folder forcefully
terminate the running browser by PID so that they can modify its profile and relaunch it with their own settings. If confirmed malicious, this
could allow an attacker to tamper with browser preference files, side-load extensions and redirect the victim's browsing traffic.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a sequence where an Apache HTTP server spawns a shell (sh, bash, dash) followed within a 6-hour window by network connections to internal ports (LDAP, SMB, Kerberos) from the same device, indicative of web shell activity and potential internal reconnaissance or relay attempts.
Displays commands that were executed with parent processes commonly associated with lateral movement. Will need tuning per environment.
Detects behavior where PowerShell or pwsh executes msiexec.exe to silently install an MSI file located in a temporary directory with a GUID-prefixed filename, optionally following a recent download from a remote URL.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Page 26 of 2906