Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,680
9,759
6,693
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects the Windows Help executable (hh.exe) launching the Windows script interpreters (wscript.exe or cscript.exe) with suspicious command-line flags. This pattern is commonly used in fileless malware delivery, script-based obfuscation, and bypass of security controls using built-in Windows utilities.
Detects the creation of a specifically named exfiltration file ('edgeLog.txt') followed by an outbound network connection over port 443 originating from the same process storyline. This pattern is indicative of a process staging stolen data to disk and subsequently exfiltrating it over an encrypted channel to an external destination.
This rule detects the creation or modification of core Chrome extension files (manifest.json, background.js, search.html) within the Chrome User Data directory by processes other than standard Chrome executables (chrome.exe, chromium.exe, googleupdate.exe). It also includes a specific alert for a known extension identifier. This activity is often indicative of unauthorized browser extension installation, potentially for persistence, credential theft, or malicious C2 activity.
Detects the use of the klist.exe utility with suspicious subcommands ('sessions', '-li', 'get', 'purge') to inspect, retrieve, or clear cached Kerberos tickets, which is indicative of credential discovery or post-exploitation activity.
Detects the abuse of the Windows Error Reporting (WER) service mechanism, specifically targeting the 'QueueReporting' scheduled task. Attackers may employ junction-based path redirection to execute a malicious wermgr.exe binary located outside of the standard system directory. The rule identifies instances where wermgr.exe is running from non-standard locations, or running at SYSTEM integrity level spawned by standard task-related parent processes, which indicates a potential privilege escalation or persistence attempt (linked to CVE-2026-50656).
Detects the execution of known Windows binaries (fodhelper.exe, eventvwr.exe, computerdefaults.exe) which are frequently abused for User Account Control (UAC) bypass by exploiting their auto-elevation capability. These binaries are monitored as either the parent process or the target image, which is a common indicator of a UAC bypass attempt.
This rule detects the execution of PowerShell via wscript.exe or certutil.exe, followed by the use of suspicious command-line arguments often associated with malicious fileless execution, such as downloading content from the web or executing base64 encoded payloads.
Detects suspicious execution patterns involving the Microsoft HTML Help executable (hh.exe). This includes the execution of Compiled HTML (.chm) files, or cases where hh.exe is used as a parent process to spawn common scripting or command-line interpreters such as wscript.exe, cscript.exe, powershell.exe, or cmd.exe. These behaviors are common indicators of malicious script execution or proxy execution techniques used to bypass security controls.
This rule detects instances where the Microsoft Defender process (MsMpEng.exe) spawns common command-line or scripting interpreters such as cmd, powershell, or wscript with System integrity. This behavior is highly irregular for a security product and may indicate process injection, defensive evasion, or malicious activity masquerading as a legitimate system process.
Detects indicators of exploitation attempts against the CVE-2026-55200 libssh2 heap out-of-bounds write vulnerability. The rule identifies the creation of known PoC artifacts on disk, execution of exploit harnesses or probe binaries, Python scripts masquerading as or interacting with the PoC server, and libssh2-dependent client applications making network connections to the non-standard port 2222 used by the exploit scaffold.
Detects the invocation of script interpreters (python, bash, powershell, etc.) initiated by package management utilities (pip, npm, gem). This pattern is often indicative of supply chain attacks, automated malicious script delivery, or post-exploitation activity where legitimate development tools are abused to execute encoded or obfuscated commands.
This rule monitors for the installation or loading of a specific driver file, 'pcdhost.sys', through file creation, registry modifications for services, or image loads. It then correlates this activity with subsequent rapid process termination events on the same host, flagging cases where five or more processes are terminated within a 5-minute window following the driver activity.
Detects the execution of 'client32.exe', which is the executable for NetSupport Manager remote control software, when it is located outside of its standard installation directory. This can be indicative of a portable or unauthorized remote access tool being deployed by an adversary for persistence or command-and-control.
Detects indicators of a malicious driver or associated activity named 'pcdhost.sys'. The rule monitors for the installation of this driver via 'sc.exe', registry modifications related to this filename, the creation of this file on disk, and specific suspicious process command-line artifacts ('AtLorenBase', 'MANPO: ReadModule', 'PERS: FAIL', 'RUNPE:', 'POST: hollow=') typically associated with malware or offensive toolkits.
Detects a suspicious volume of image file creation events (more than 3) within the 'C:\Users\Public\Videos\' directory, matching a pattern commonly used for automated screen capture tools.
Detects the execution of the Windows command shell (cmd.exe) originating from either Windows Explorer or the RemoteMouse application. This activity often indicates an attempt to gain manual command-line interaction with the system, potentially through a malicious file execution, social engineering, or exploitation of the RemoteMouse application.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
This rule detects the execution of processes named 'RoguePlanet.exe' and monitors for inter-process communication using named pipes with the same name. This pattern is indicative of a specific malware payload attempting to establish communication channels for C2 or process interaction.
This rule detects command-line activity and process execution associated with the exploitation of various Linux kernel vulnerabilities, including CVE-2026-43503, CVE-2026-46300, CVE-2026-43284, CVE-2026-31431, and CVE-2026-43500. It monitors for the compilation and execution of exploit code, manipulation of kernel modules via modprobe for specific network protocols (esp4, esp6, rxrpc), configuration changes to network namespaces (xfrm, unshare), and the presence of known exploit filenames like DirtyClone or DirtyFrag.
This rule detects the use of 'sc.exe' to interact with services related to 'Mixed Reality' (a potential name masquerading technique) where the parent process is not the standard 'services.exe' or 'svchost.exe'. The rule also correlates this activity with the invocation of command interpreters like 'cmd.exe' or 'conhost.exe' by the parent process, which is highly indicative of malicious service manipulation or lateral movement.
Detects the injection of code into an svchost.exe process from a non-system directory, followed by the loading of .NET CLR runtime modules (clr.dll, clrjit.dll, or mscorlib.ni.dll) within 5 minutes. This pattern often indicates an attempt to execute managed code inside a legitimate system process, potentially to evade security controls. The rule further enriches the finding by identifying if the svchost.exe process is running in a non-standard service group, which serves as a high-confidence signal of anomalous behavior.
Page 33 of 100