Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,759
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects anomalous application crashes of network-oriented utilities (curl, git, sftp, etc.) that leverage libssh2. This pattern is indicative of a heap over-read vulnerability, such as CVE-2025-15661, triggered by a malicious SFTP server response during an outbound session.
This rule detects 'git clone' operations on Windows systems that are correlated with the creation of or access to specific Amazon Q or VSCode Model Context Protocol (MCP) configuration files ('mcp.json'). The rule identifies potential unauthorized project cloning or reconnaissance activity involving developer tools.
Detects artifacts, execution of harness tooling, and post-exploitation behavior associated with CVE-2026-55200 in libssh2. The rule monitors for the presence of known exploit filenames (libpwn), suspicious Python script execution, unexpected shell spawning from SSH-enabled clients, and outbound network connections to non-standard ports typical of exploit scaffolding.
This rule detects the creation of new executable files in suspicious locations, specifically targeting potential masquerading or evasion attempts in Windows Error Reporting (WER) paths (using randomly named folders) and generic Windows Temp directories by non-system accounts (excluding Microsoft Defender's engine process).
Detects instances where a non-root user executes the 'sudo' command in combination with 'tee'. This pattern is frequently used to bypass file permission restrictions by appending or writing content to sensitive system files that would normally require root privileges, a common method for privilege escalation or maintaining persistence.
This rule detects potential persistence via Windows Registry Run keys by monitoring for the creation or modification of values pointing to suspicious paths (e.g., AppData, Temp, winupdate.exe). It also identifies suspicious execution of files originating from user-writable directories, specifically looking for indicators of PyInstaller-packaged executables or specific known malicious hashes, which are frequently used by adversaries for malware deployment.
This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.
Detects Python processes spawned by development tools (VSCode, Cursor) or Node.js that are engaged in suspicious activities, specifically communicating with the Telegram Bot API or uploading large amounts of data, often accompanied by file staging (ZIP archive creation). This behavior is characteristic of the InvisibleFerret information stealer.
This rule monitors for the execution of common remote access and support tools (AnyDesk, TeamViewer, ScreenConnect, QuickAssist) that originate from suspicious file paths (e.g., Temp, AppData, Downloads) or are launched with silent installation flags, or appear to be installed via msiexec by non-standard parent processes. These behaviors are common indicators of adversaries attempting to establish unauthorized persistent remote access or deploying remote support tools as part of a post-exploitation activity.
Detects the execution or loading of executables (.exe) or dynamic link libraries (.dll) located in user-specific temporary or roaming directories (AppData). These directories are common locations for attackers to drop payloads, execute malicious code, or achieve persistence, as they are writable by standard users without elevated privileges. The rule includes filters for known legitimate processes that may perform operations in these directories to reduce noise.
This rule monitors process execution events for the presence of known penetration testing and post-exploitation tools, specifically NetExec (formerly CrackMapExec), nxc, or cme. These tools are frequently used by adversaries for network discovery, lateral movement, and credential harvesting within Active Directory environments.
Detects instances where files located in root or non-standard paths are opened by processes that are not core Windows system processes or Microsoft security products, which may indicate suspicious activity such as manual file interaction or discovery.
Detects the creation or modification of Windows kernel-mode services using the sc.exe utility when the process is not initiated by the legitimate service control manager (services.exe). This behavior is often associated with the loading of malicious drivers or rootkits, which may attempt to bypass standard service management processes to maintain persistence or elevate privileges.
Detects modifications to Windows boot configuration or registry settings to enable 'testsigning' mode. Enabling testsigning allows for the loading of unsigned drivers or software into the kernel, which is a common technique used by attackers to bypass driver signature enforcement for rootkit or malicious driver deployment.
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
Detects potential execution of Remcos Remote Access Trojan (RAT) components or process masquerading activity involving 'explorer.exe'. The rule identifies suspicious file paths (e.g., ProgramData\Remcos\) and instances where processes named 'explorer.exe' execute from non-standard Windows directories, indicating an attempt to hide malicious activity or masquerade as a legitimate Windows system process.
This rule detects when a signed process loads a DLL file from common user-writable directories (AppData, ProgramData, Public, Downloads). It further filters by verifying that the DLL is located in the same directory path tier as the executing process, which is a common indicator of side-loading or DLL hijacking activity where an attacker places a malicious DLL alongside a legitimate executable.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects artifacts and activity related to the exploitation of CVE-2026-55200 in libssh2. The rule monitors for the creation or execution of identified libpwn exploit harness files and scripts, as well as suspicious network activity involving TCP port 2222, which is the default port for the PoC rogue SSH server. It also correlates the appearance of these exploit files with subsequent outbound SSH connections.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
Page 35 of 100