Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects network connection activity originating from QEMU virtualization processes (qemu-system-x86_64, qemu-system-i386, qemu-system-aarch64) to external (non-private/non-local) IP ranges. This could indicate the use of virtualization tools to facilitate tunneling, proxying, or lateral movement within an environment.
Open-source derived remote access trojan with plugin architecture
Detects Node.js or npm processes that access multiple SSH-related files within a short timeframe while also establishing external network connections, which is consistent with credential exfiltration patterns.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
This rule detects when a Node.js or NPM process accesses multiple sensitive browser credential files (Login Data or Cookies) within a short window, while simultaneously reading shell history files (bash_history, zsh_history, or fish_history). This behavior is characteristic of an automated credential harvester or infostealer script executing within a Node.js environment.
Detects suspicious kernel-level activity following a potential privilege escalation event on Linux systems. The rule monitors for unauthorized kernel module loading (via non-standard paths) or direct write access to /dev/kmem, which is indicative of rootkit installation or kernel-level memory manipulation.
Detects Node.js processes accessing paths associated with cryptocurrency wallets and browser extension storage (MetaMask, Phantom, Exodus, Electrum). This behavior is characteristic of infostealer malware attempting to exfiltrate seed phrases, keys, or wallet configuration data.
This rule monitors for high frequency network connections (more than 50 requests) initiated from internal endpoints to external (non-RFC1918) IP addresses over port 443. This pattern may indicate beaconing activity, command and control (C2) communication, or significant data exfiltration to an external host.
Detects OceanLotus-related DLL sideloading and code injection techniques. This rule monitors for masqueraded executables (IntelAudioService, HP Toolbox variants) launched with suspicious flags (appmodel/StateRepository, -uiDll), the loading of the SPECTRALVIPER loader module (DtlCrashCatch.dll), and cross-process injection attempts from known malicious sideloading binaries.
Detects cross-process memory operations and remote thread creation associated with the SPECTRALVIPER sideloading chain. It specifically flags injections originating from IntelAudioService.exe into OneDrive or svchost processes, the loading of the DtlCrashCatch.dll module, and general suspicious remote thread or memory write operations against these targets, excluding known system processes and security software.
Detects instances where the Windows Subsystem for Linux (wsl.exe) process is used to launch standard Windows command-line interpreters (cmd.exe, powershell.exe, or pwsh.exe). This pattern is often used as a technique to facilitate cross-environment execution or to evade certain security controls by running Windows binaries from within the WSL context.
Detects the execution of the Linux uptime utility, either as a standalone process or via common web server parent processes (nginx, httpd, apache), particularly when associated with suspicious command-line arguments or network activity. This behavior is often associated with reconnaissance or post-exploitation activities.
Detects the use of package management or file integrity monitoring tools (rpm, dpkg, debsums, aide, inotifywait) to verify or interact with critical SSH/PAM configuration files, or the use of inotifywait to monitor SSH configuration access. This behavior may indicate an adversary attempting to verify compromised configurations, check for the presence of backdoors, or monitor security modifications.
Detects network enumeration tools (netstat.exe, ss.exe) when executed by a suspicious process or from directories associated with the JFMBackdoor malware infection (e.g., fltMC.exe or common staging paths like C:\ProgramData\ and \temp\).
Detects the JFMBackdoor utility masquerading as fltMC.exe by executing from a non-standard location (typically %TEMP%) and performing timestomping operations via SetFileTime. This technique is used to manipulate MACE timestamps as an anti-forensic measure.
Detects the use of the Windows registry utility 'reg.exe' to query sensitive registry keys (SYSTEM, SOFTWARE, RUN keys) when executed by suspicious parent processes commonly used for script execution or living-off-the-land techniques (wscript.exe, cscript.exe, fltMC.exe, mshta.exe). This pattern is often indicative of automated discovery or credential harvesting behaviors.
Detects the creation of a Windows service using the 'sc.exe' utility where the service executable is located in a potentially untrusted directory such as Temp, AppData, ProgramData, Users\Public, or Downloads. This behavior is frequently used by adversaries to establish persistence or execute malicious code with elevated privileges.
This rule identifies potential use of the Tor network by detecting network connections to common Tor relay ports (9001, 9030, 9050, 9051, 9150) that are external to internal subnets, or by identifying DNS requests for .onion domains.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Detects the execution of known Remcos Remote Access Trojan (RAT) watchdog processes (e.g., iexplore.exe, svchost.exe, fsutil.exe) when spawned by suspicious parent processes or running from non-standard file paths such as Temp, AppData, or ProgramData, which are common indicators of malicious activity.
Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.
Page 41 of 100