Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects delivery and execution artifacts associated with the BlueMoon CVE-2026-85046 V8 type-confusion exploit. The rule monitors for known exploit-related file names (e.g., driver-html.js) and characteristic string indicators (e.g., v8ctf_exp_attempt, addrof, fakeobj) across file system, process execution, and network telemetry.
Detects the loading or installation of specific NVIDIA file system filter drivers ('Alinubx.sys', 'CcProtect.sys', 'nvfsflt64.sys') or services related to the 'NvFsFilter'. These drivers are associated with NVIDIA driver components; however, they can be targeted for unauthorized usage or mimicry.
Detects instances where the Visual Studio Debugger (vsdbg.exe) spawns a child process that is not expected, such as common VS diagnostic tools or standard Microsoft/Windows binaries. This is used to identify potential process injection or abuse of the debugger for executing unauthorized payloads.
This rule detects attempts to bypass Windows User Account Control (UAC) by identifying processes that use specific command-line arguments (such as /Elevation:Administrator, /shell:RunAs, or /runas /savecred) combined with known binaries (such as vsdbg, rundll32, or cmstp) often abused to achieve elevated privileges or proxy execution of malicious code.
This rule detects potential security software tampering by identifying the loading of a specific driver (Alinubx.sys) followed by the termination or interference of common security agent processes within a short timeframe. This behavior is indicative of an adversary attempting to disable endpoint protection using a Bring Your Own Vulnerable Driver (BYOVD) or malicious driver approach.
Detects the loading of the hostfxr.dll module, the presence of the DLLMemLoader string in command lines, or the execution of python or pythonw processes. These patterns are often associated with the loading of malicious assemblies or execution via scripting environments.
Detects the loading of the System.Management.Automation.dll (PowerShell assembly) by processes other than standard PowerShell executable files. This behavior often indicates an attempt to execute PowerShell code from a non-standard process, potentially to bypass security controls or obfuscate malicious activity.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden window, download strings, or invocation commands) initiated by Windows Explorer. This is a common pattern for malicious scripts or droppers attempting to execute code covertly.
Detects creation of a token.cmd file in AppData followed by its execution via cmd.exe within a 5-minute window.
Detects a process that deletes its own executable or script file within a short time window after launch, which is a technique used by some implants.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects creation of a token.cmd file in AppData followed by its execution via cmd.exe within a 5-minute window.
Detects creation of .git-checker files in temporary directories, a pattern associated with potential malicious activity.
Detects creation of .git-checker files in temporary directories, a pattern associated with potential malicious activity.
Detects creation of .git-checker files in temporary directories, a pattern associated with potential malicious activity.
Detects creation of .git-checker files in temporary directories, a pattern associated with potential malicious activity.
Detects a Node.js process executing a JavaScript file that spawns a secondary Node.js child process, followed immediately by the creation or modification of Windows Run registry keys for persistence. This sequence is indicative of malicious npm package activity where a secondary, hidden payload is downloaded and configured to execute upon system startup.
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
Detects the PolinRider/GHAPPIER campaign signature of a malicious loader payload silently appended to the end of a legitimate project configuration file
Page 318 of 1908