Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule monitors process execution events for the presence of the Chisel network tunneling tool. It identifies Chisel by its executable names (e.g., chisel.exe, chisel_linux) and command-line arguments typical of a Chisel client or server configuration, including SOCKS proxy setups and known indicator ports.
Detects the execution of Ghostscript (gswin64c.exe) by ImageMagick (magick.exe or convert.exe), where the binary location does not appear to be a standard installation path. This behavior is a common indicator of exploitation attempts against ImageMagick vulnerabilities, such as ImageTragick or subsequent Ghostscript-based file processing exploits.
This rule monitors DNS query logs for requests to specific domains associated with malicious activity. It aggregates these requests by endpoint to identify potential command and control (C2) communication or beaconing behavior.
This rule detects processes that are not common browsers (chrome, msedge, firefox, etc.) initiating a network connection over the STUN protocol (UDP port 3478) while simultaneously running with a command-line argument containing '--kiosk'. This pattern often indicates potential command-and-control (C2) communication or unauthorized network traversal disguised as normal traffic from kiosk-mode applications.
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
Detects the creation or modification of a scheduled task named 'OneDrive Update', which is known to be used by the BLUERABBIT backdoor for persistence. The rule looks for Windows Security Events (EventID 4698 for task creation, 4702 for task modification) and process execution events where command lines indicate scheduled task registration via tools like 'schtasks', 'Register-ScheduledTask', or 'New-ScheduledTask' with the specific task name 'OneDrive Update'.
Detects instances where the WinRAR process (winrar.exe) spawns common script interpreters or command-line shells, including mshta.exe, wscript.exe, cscript.exe, powershell.exe, or pwsh.exe. This behavior is often indicative of an adversary attempting to execute malicious code embedded in or extracted from a compressed archive.
This rule detects the execution of Mimikatz via process name matching or the presence of known credential dumping command-line arguments (e.g., 'sekurlsa::logonpasswords' or 'privilege::debug'). These indicators are commonly used by adversaries to extract sensitive information like plaintext passwords or hashes from the LSASS memory process.
Detects outbound network connections to 'stitch-production.org' or connections by node/bun runtime processes to GitHub API or 'stitch-production.org', which may indicate command and control communication or data exfiltration.
Detects the creation of an Amazon Q Model Context Protocol (MCP) configuration file. This file is used to define tools and resources for Amazon Q, and its creation could indicate a user configuring external tool access for the AI assistant or an adversary attempting to influence its capabilities.
This rule monitors process execution events for the 'aa-exec' utility, a tool often used in containerized environments (such as AppArmor) or specific runtime configurations, when invoked with specific command-line arguments (-p trinity, -p chrome, or -p flatpak). These patterns are indicative of specialized container or sandbox execution activities that may warrant investigation in specific enterprise environments.
This rule detects command line activity associated with the exploitation of a Linux kernel vulnerability involving packet editing (often referred to as the 'pedit' or 'act_pedit' vulnerability). It monitors for the execution of exploit-specific binaries, kernel module loading of 'act_pedit', use of 'unshare' for namespace abuse, and configuration of 'tc' (traffic control) filters related to the exploit.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
Detects the execution of QEMU binaries (qemu-system-x86_64, qemu-img, qemu-system-i386, qemu-system-aarch64) when launched from parent processes that are not standard virtualization or emulation management tools. This can indicate the use of QEMU for malicious purposes, such as unauthorized virtual machine execution, persistence, or secondary staging on a compromised host.
This rule monitors for processes that establish a network connection to specific Cloudflare IP address ranges (104.21.0.0/16 and 172.67.0.0/16) within a 5-minute window. This can be indicative of communication with command and control infrastructure, proxies, or content delivery networks used by adversaries.
This rule detects a sequence of events where specific potentially malicious parent processes spawn child processes (WizardDa42.exe or AlphVector.exe spawning NeuroManag.exe or VirtualAr.exe). Following this, the child process is observed loading a .tmp file from the AppData Local Temp directory, followed shortly by the loading of ntdll.dll. This pattern is often indicative of process injection or hollowed process behavior where a payload is dropped as a temporary file and subsequently executed or reflected in memory.
Detects potential User Account Control (UAC) bypass attempts using known techniques involving the execution of fodhelper.exe or eventvwr.exe, or by abusing the Mozilla ElevateTask task scheduler configuration.
Detects a DLL being loaded into a system process (e.g., Windows/System32, Program Files) from a suspicious or user-writable directory (e.g., AppData, Temp, Downloads), followed by a network connection originating from the same process within a 10-minute window. This behavior is indicative of DLL side-loading used to execute a payload that subsequently initiates C2 communication.
Detects an executable or file running from a common temporary or user-writable location (e.g., AppData, Temp, ProgramData) that is followed within two hours by a modification to a Windows 'Run' registry key referencing a file in the same suspicious directory structure.
This rule detects processes executing from commonly abused, high-write temporary or user-specific directories (AppData, Temp, ProgramData) that simultaneously initiate network connections to external IP addresses over HTTP/HTTPS ports (80/443). This pattern is frequently indicative of initial stage malware, downloader behavior, or command and control communication originating from non-standard execution paths.
This rule detects processes running from common user-writable directories (AppData, Temp, ProgramData, etc.) that concurrently establish outbound network connections to non-private (non-RFC1918) IP addresses. It explicitly excludes common browsers, accessibility tools, and known Windows system or product-related paths to reduce noise.
Page 44 of 100