Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects instances where the ScreenConnect remote support client initiates outbound network connections to an unusually high number of distinct remote IP addresses (greater than 5). This behavior is characteristic of unauthorized lateral movement, reconnaissance, or establishing multiple C2 tunnels via a legitimate RMM tool.
Detects instances where permissions related to file transfers are granted or accessed within a ScreenConnect remote access session. This rule monitors for session-related events or permission updates that could indicate an attacker leveraging the remote access tool to exfiltrate data or interact with the filesystem.
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) initiates execution of common command-line utilities or scripting interpreters, such as cmd.exe, powershell.exe, or certutil.exe. This behavior is highly atypical for web servers and is often indicative of exploitation attempts or post-exploitation activities following an initial compromise of a web application.
This rule detects potential web shell activity on Microsoft Exchange servers by identifying suspicious processes (like cmd.exe, powershell.exe) spawned by w3wp.exe (IIS worker process) that are associated with the creation or modification of common web shell file extensions (.aspx, .ashx, .asax) within critical Exchange server directories.
This rule monitors for execution patterns associated with the Evil-WinRM tool, a common post-exploitation framework used for remote command execution via WinRM. It identifies suspicious command-line arguments in PowerShell, the creation of configuration files typical of the tool, and network connections to WinRM ports initiated by common execution binaries like PowerShell or Ruby.
Detects high-frequency execution of Python interpreter processes within a short timeframe (40+ distinct command lines in 15 minutes). This behavioral pattern is indicative of automated or autonomous agent-driven payload delivery and execution, as seen in JADEPUFFER and ENCFORGE campaigns.
This rule detects attempts to exploit Apache Nacos vulnerabilities, including authentication bypass and unauthorized administrative account creation. It monitors process executions of common tools (like curl and java) and network connections targeting known Nacos service ports (8848, 9848) containing indicators of exploit patterns such as login bypass endpoints or SQL injection sequences targeting the user table.
This rule detects suspicious child processes, such as shells and system utilities, spawned by PaperCut application processes (pc-app.exe, pc-app-service.exe) or associated Java/Tomcat service components. This pattern is commonly observed during exploitation attempts targeting PaperCut Print Management software, where attackers use web services to gain command execution.
Detects potential web shell or malicious DLL deployment into Microsoft Exchange or IIS directories by the IIS worker process (w3wp.exe), as well as suspicious child process execution (such as command-line shells or credential discovery tools) spawned directly from IIS worker processes.
Detects the presence of natural-language self-narration in code comments within Python or SQL scripts. This pattern is indicative of LLM-driven agentic execution, where automated agents narrate their own malicious actions, such as enumeration, data exfiltration, or database manipulation, as observed in the JADEPUFFER campaign.
Detects the execution of MySQL process command lines that simultaneously contain the strings 'AES_ENCRYPT' and 'UPDATE'. This pattern often indicates attempts to manipulate data within the database via SQL injection or unauthorized database modification.
Detects potential SQL injection attempts by monitoring for 'INSERT INTO' SQL commands executed via command-line arguments. The rule specifically looks for operations targeting user or role tables and including administrative keywords, originating from database or application-related processes like mysql or java.
Detects when ScreenConnect client processes (ClientService.exe or WindowsClient.exe) spawn child processes that are not part of the standard ScreenConnect application suite. This behavior is indicative of unauthorized use of remote access tools for command execution or lateral movement.
Detects execution of PowerShell or CMD initiated by the Kimsuky GitPower loader. The rule identifies suspicious command-line artifacts including excessive character padding (leading spaces), extremely long command lines, and the presence of a hardcoded, unique base64 decoding variable ('$VIUSBvejbawf') associated with this specific malware family.
Detects the Kimsuky second-stage payload test.bef_fri which masquerades as an RTF file via a falsified RTF header before header repair and decompression
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
This rule detects a correlation between host-level reconnaissance activity using WMI (via PowerShell or WMIC) to query system information, followed by network exfiltration to a known C2 IP address over a specific URI within a 10-minute window.
Detects the execution or file activity associated with the 'OrionQuests-Setup.exe' installer. This rule monitors both process creation and file system activity to track the presence and usage of this specific installer executable, which may indicate the installation of potentially unauthorized or untrusted software.
Detects the execution or file activity associated with the 'OrionQuests-Setup.exe' installer. This rule monitors both process creation and file system activity to track the presence and usage of this specific installer executable, which may indicate the installation of potentially unauthorized or untrusted software.
Detects the presence or execution of a specific file hash associated with a known malicious campaign (KREMLIN/REF9334) that leverages a signed SentinelOne binary. This indicates potential abuse of trusted code-signing to bypass security controls.
Detects Remote Desktop Protocol (RDP) connections established over known suspicious high ports or to specific remote IP addresses associated with known C2 operator infrastructure (SpiceRAT). This behavior indicates potential remote interactive access by an adversary.
Page 322 of 1908