Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects unauthorized, unsigned processes accessing sensitive browser files (Cookies, Login Data, Local State) across common browsers (Chrome, Edge, Brave, Firefox) followed by an outbound network connection. This behavior is indicative of credential-harvesting infostealer malware.
Detects suspicious cross-process memory access events, such as PROCESS_VM_WRITE and PROCESS_SUSPEND_RESUME, often indicative of process hollowing or Early Bird APC injection. The rule monitors for elevated granted access masks originating from non-system processes, a behavior associated with the CLOSEDQUORUM implant's post-compromise activities.
Detects the execution of msiexec.exe with flags indicating a silent installation (/passive) where the package source is a remote URL (http:// or https://). This behavior is commonly associated with ClickFix campaigns and other malware delivery methods that attempt to trick users into installing malicious Windows Installer packages.
Detects execution of msiexec.exe via the Windows Run dialog (launched by explorer.exe) that utilizes a remote URL for an MSI installer alongside suspicious property flags ('ORG_NOTE', 'passive'). This pattern is associated with 'ClickFix' social engineering campaigns where users are instructed to copy-paste commands to 'fix' a display issue, leading to the execution of malicious installers.
Detects a suspicious PowerShell execution chain originating from explorer.exe, typically associated with ClickFix social engineering campaigns. The command uses 'Invoke-RestMethod' (irm) to download content, saves it to the user's TEMP directory, and immediately executes the downloaded script.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
Detects reconnaissance and persistence behaviors associated with the Akira ransomware attack chain, specifically the execution of the Cloudflare Tunnel daemon for remote access or the creation/modification of local user accounts via standard Windows tools.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects the execution of PowerShell from web browser parent processes (chrome, edge, firefox, iexplore) using obfuscation techniques (hidden window, encoded command, no profile) combined with an indicator of WebDAV access (DavWWWRoot), which is commonly used to execute payloads from remote network shares.
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
This rule detects the use of 'mshta.exe' to execute HTML (.html, .htm) or MHTML (.mhtml, .mht) files. This behavior is often associated with bypassing Mark-of-the-Web (MotW) protections, as attackers may use container formats to deliver files that do not properly inherit MotW markings when extracted, allowing them to be opened by 'mshta.exe' without restrictive security policies.
Detects execution of a renamed Python interpreter (python.exe, ipy.exe, ipy64.exe) from suspicious locations (e.g., Temp, Downloads) or when launched by common web browsers and shell processes. This behavior is indicative of an adversary attempting to execute malicious scripts while masquerading as a legitimate process to evade detection.
Detects suspicious commands or script-based execution strings being inserted into the Windows Explorer 'TypedPaths' registry key. This registry key stores the history of paths entered into the Windows Explorer address bar, and attackers can abuse this mechanism to execute arbitrary commands by pasting malicious strings that are then interpreted or executed by the shell.
Detects suspicious command-line fragments being written to the Windows RunMRU registry key, which is used by the Explorer 'Run' dialog to store history. Adversaries may abuse this by injecting malicious command lines that are then executed when a user attempts to run a program.
FileFix loader chains abuse trusted code-hosting platforms like Bitbucket/GitHub to host staged payload components, exploiting domain trust to evade network detection.
A documented FileFix variant arrives as an HTML/MHTML email attachment styled to look like a Word document or PDF, displaying a fake 'file could not be rendered' prompt that leads into the address-bar paste.
Detects mshta.exe spawning suspicious child processes (cmd.exe, powershell.exe, or reg.exe) that are characteristic of the ReverseRAT backdoor. The rule identifies common discovery commands or persistence attempts via Registry Run keys triggered from mshta.exe.
Detects MayaBot's scheduled-task persistence chain by correlating two signals on the same device within a 60-minute window: (1) schtasks.exe creating a daily task referencing a hidden batch script (update.bat/backup.bat/firewall-update.bat) under AppData\Local, spawned from wscript.exe/cscript.exe/cmd.exe, and (2) cmd.exe launching a hidden-window PowerShell process referencing the same batch scripts under AppData\Local. Requiring both signals together, anchored to the AppData\Local path, sharply reduces false positives compared to alerting on either behavior alone.
Detects the execution of known NTLM relay and coercion tools (such as PetitPotam, EfsPotato, PrinterBug, DFSCoerce, or Coercer) when attempting to coerce a local authentication or credential relay using the local loopback address. These tools leverage various RPC-based techniques to force the local machine to authenticate to an attacker-controlled source, facilitating NTLM relay attacks.
Detects the loading of the malicious NvFsFilter driver (a BYOVD technique often used by the Rapuncel infostealer) followed immediately by a mass burst of process terminations, indicating an attempt to disable security software.
Page 36 of 465