Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule identifies potential malicious activity by detecting the presence of known malicious file hashes (SHA256 and MD5) on endpoints and monitoring for DNS queries or network connections to a known malicious staging domain (yapw.life). The detection correlates file execution, file activity, and network communication to identify stages of an attack such as malware installation or C2 communication.
Detects the execution of PowerShell with encoded commands, specifically when initiated by a 'conhost.exe' process running with the '--headless' flag. The rule further inspects the decoded command to identify patterns indicative of .NET reflection-based code execution, often used in malicious activity such as reflective assembly loading.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule monitors for potential suspicious database operations executed via MySQL command-line utilities. It specifically detects the use of the AES_ENCRYPT function in conjunction with UPDATE statements, which is a technique often used by ransomware to encrypt database tables or data.
This rule detects the execution of Mimikatz or the use of its specific command-line arguments, which are strongly indicative of credential dumping activities, often used for post-exploitation lateral movement or privilege escalation.
This rule detects a multi-stage attack pattern originating from a web-based service. It identifies a web application process (like w3wp.exe, httpd.exe, or java.exe) spawning suspicious child processes (cmd.exe, powershell.exe, etc.), followed by the creation of new files and external network connections. This chain of behavior is highly indicative of web shell exploitation, post-exploitation command execution, and data exfiltration or C2 communication.
This rule detects established outbound network connections to 'devtunnels.ms', which is a legitimate service often abused by adversaries to tunnel RDP traffic and bypass network security controls or firewall restrictions. This behavior is indicative of unauthorized remote access setup.
This rule detects processes accessing or files being interacted with that are known to contain sensitive information, including API keys, credential files, database configurations, and cryptocurrency wallets. It monitors command-line activity for utilities like python, bash, and grep interacting with sensitive strings, and tracks file system access to sensitive paths.
Detects the use of ScreenConnect client processes initiating rapid outbound network connections to multiple distinct devices within a short timeframe (1 hour). This behavior is often indicative of unauthorized lateral movement, automated discovery, or mass-deployment of remote access sessions using legitimate administrative software.
Detects a sequence of activity involving the use of the MySQL 'AES_ENCRYPT' function followed by a 'DROP TABLE', 'DROP SCHEMA', or 'DROP DATABASE' command on the same host within a 30-minute window. This behavior is consistent with extortion tactics, such as the JADEPUFFER campaign, where attackers encrypt sensitive database records and delete the original tables to compel ransom payments.
Detects the ScreenConnect remote access binary spawning suspicious child processes often associated with lateral movement, system reconnaissance, or anti-forensics activity (such as deleting shadow copies, modifying boot configuration, or using administrative tools for remote command execution). This behavior is highly indicative of an adversary abusing legitimate RMM software to execute post-exploitation commands.
Detects the execution of 'SimpleService.exe' when the binary is located within a restricted subdirectory associated with JWrapper-Remote Access. This pattern may indicate the execution of unauthorized or restricted remote access tools.
Detects the addition of a user to the 'Domain Admins' group using common administrative command-line tools such as net group, Add-ADGroupMember, dsadd, or net localgroup. This serves as a proxy indicator for potential privilege escalation.
Detects instances where a Langflow process spawns a Python process using command-line arguments involving base64 decoding or character-based execution, which is often indicative of malicious code injection or shellcode execution.
Detects file creation events initiated by ScreenConnect (ConnectWise Control) client processes. ScreenConnect is a legitimate remote support and RMM tool often leveraged by adversaries for remote access or as a secondary persistence mechanism. Monitoring file creation by these processes may indicate the installation of additional tools, scripts, or malware via a remote support session.
Detects the use of native Windows utilities (vssadmin, wbadmin, bcdedit, wmic) to delete volume shadow copies, backup catalogs, or disable system recovery features. This behavior is a common precursor to or component of ransomware encryption operations intended to prevent system recovery.
Detects potential SQL injection attempts by monitoring for 'INSERT INTO' SQL commands executed via command-line arguments. The rule specifically looks for operations targeting user or role tables and including administrative keywords, originating from database or application-related processes like mysql or java.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects the presence of known malicious RubyGems package names and Cross-Site Scripting (XSS) payloads within process commands, file paths, or network URLs, indicative of an attempt to target repository registries or administrative interfaces with supply chain injection attacks.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Page 345 of 1908