Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
This rule detects the connection of external Plug and Play (PnP) devices, including USB storage, to a system. It identifies events where a USB drive is mounted or a generic PnP device is connected, extracting details such as vendor, product ID, and serial number for investigation.
Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.
Detects the creation of the 'UPlugPlay' Windows Service, a known persistence mechanism for the Prometei botnet. The malware may create the service using the command-line tool 'sc.exe' or directly via Windows APIs, which generates Event ID 7045.
Detects instances where a LNK file execution is followed by the launch of a PowerShell process that contains command-line arguments for downloading and/or executing content from the internet. This behavior is the initial execution step in the attack chain detailed in the referenced Fortinet report.
This rule detects when a process, potentially a Go-compiled binary (indicated by 'go' in the command line), establishes persistence by creating or modifying a registry run key or by dropping a file in a startup folder. This behavior is associated with the Moonrise RAT.
Detects persistence via an Internet Shortcut (.url) file in a startup folder that points to a local executable (file://). This is a known TTP of the PHALT#BLYX campaign.
Detects the execution of QEMU where a .dll file is specified as a hard disk image. This is a known TTP associated with the "Bring Your Own Hypervisor" (BYOH) technique, where attackers hide malicious activity within a virtualized environment using non-standard disk image formats.
Detects svchost.exe spawning a shell process (cmd.exe or powershell.exe) where its parent is not the legitimate services.exe. This behavior is a known technique used by Moonrise RAT to proxy commands and evade detection. The rule further scopes to commands targeting temp or public directories, which are common malware staging areas.
Detects NetSupport RAT persistence established via a Registry Run key, followed by the clearing of the RunMRU history. This sequence of events is a known TTP associated with the IClickFix framework, where adversaries attempt to hide the initial execution command after achieving persistence.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
Detects attempts to disable Windows Credential Guard by modifying the 'LsaCfgFlags' registry value. Credential Guard uses virtualization-based security to isolate secrets, and disabling it is a common defense evasion technique used by adversaries to access credentials for lateral movement.
This rule detects activity associated with a developer-targeting campaign leveraging malicious Next.js repositories. It identifies suspicious network connections to known Vercel staging domains and C2 IPs/ports/paths, as well as suspicious process execution patterns involving Node.js or VS Code related processes, and file events related to specific repository artifacts or sensitive file access by developer-adjacent processes. The detection logic covers network communication, process execution, and file system activities indicative of this specific threat.
Detects network traffic to a known StegaBin C2 IP address or specific URI paths used for data exfiltration. This activity is associated with multiple modules of the StegaBin infostealer toolkit.
Detects the loading of specific vulnerable drivers ('zam64.sys', 'UpdateCheckerX64.sys') used by ransomware groups like CrazyHunter and Interlock to terminate security products. The query combines multiple data sources to detect different stages of BYOVD activity, including driver file creation, registry entries for service creation, and command-line activity related to driver loading.
Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.
Detects non-browser processes making DNS-over-HTTPS (DoH) queries to Cloudflare's DNS service. This specific behavior is used by the Dohdoor backdoor to resolve its C2 domains while evading traditional DNS monitoring. The rule specifically looks for connections to Cloudflare's DoH service (1.1.1.1 or cloudflare-dns.com on port 443 with the /dns-query path) from processes that are not common web browsers. The fidelity is significantly increased by the optional check for the 'insomnia' User-Agent, which is characteristic of the Dohdoor malware.
This rule detects files by their SHA256 hash that are known to be associated with the exploitation of CVE-2026-1731. This includes payloads such as SparkRAT, VShell, and various web shells and droppers.
Detects instances where a development environment like VS Code or Cursor spawns a shell process that then uses a download utility to fetch and execute remote content. This is a known TTP for the 'Contagious Interview' campaign which abuses IDE task auto-execution features.
This rule detects suspicious activity related to WebView2 processes interacting with AI webchat domains, potentially indicating covert command and control (C2) proxying or other malicious use. It looks for WebView2 traffic to specific AI domains (Grok, Copilot) originating from unusual parent processes, WebView2 access to Grok with URL parameter-driven prompt execution, and suspicious child process execution (cmd.exe, powershell.exe, calc.exe) where WebView2 is the parent process.
Detects the use of the living-off-the-land binary (LOLBIN) extrac32.exe to decompress cabinet (.cab) or .vstm files from user-writable locations. This technique is used by loaders like CastleLoader to unpack malicious stages.
Page 446 of 509