Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects suspicious `conhost.exe` processes executing with the `--headless` argument and other indicators commonly associated with malware or malicious activity. The presence of `--headless` suggests an attempt to hide the console window, while additional command-line arguments like `svchost.exe`, `certutil -decode`, paths within `Users\Public` or `AppData`, and specific file extensions (`.ico`, `.png`) or keywords (`MRB_`, `DA_NEW_VER_`, `BOT`) further indicate potential compromise. The rule also looks for initiating processes like `cmd.exe`, `powershell.exe`, `curl`, or `start` which are often used to launch malicious payloads.
This rule identifies command-line arguments that contain both a Markdown (.md) file extension and a suspicious URI scheme. This pattern is indicative of an attempt to exploit vulnerabilities, such as CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links or actions through specific URI handlers.
Detects when fodhelper.exe, a legitimate Windows utility, is used to spawn processes other than cmd.exe or conhost.exe. This behavior is commonly associated with UAC bypass techniques where fodhelper.exe is abused to execute arbitrary commands with elevated privileges without a UAC prompt.
Detects a Python process spawning pip to install multiple libraries (requests, pycryptodome, psutil) in a short time frame, a behavior associated with the Arkanix Stealer's Python loader.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
This rule detects outbound network connections to known command and control (C2) infrastructure. Specifically, it looks for connections to suspicious URLs (meeting.bulletmailer.net, clawdbot.getintwopc.site, darkgptprivate.com, getintwopc.site) or specific IP addresses (179.43.176.32, 178.16.54.253), or connections on a specific port (8041) which has been associated with ScreenConnect C2. The rule also attempts to identify the specific threat indicator based on the matched URL, IP, or port.
Detects outbound network traffic to known infrastructure used in OpenClaw malicious skill delivery or credential exfiltration. These IOCs were identified in the NSFOCUS report on OpenClaw security risks.
Detects instances where the Windows 11 Notepad process (Notepad.exe) spawns unexpected child processes. This behavior is a primary indicator of the CVE-2026-20841 exploitation via malicious Markdown links, which allows for remote code execution.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit CVE-2026-20841 to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
This rule detects the installation and activation of the ClawdBot extension, likely within Visual Studio Code. It looks for the creation of specific files (extension.js, package.json, run.bat) within known VS Code extension paths and correlates this with the execution of 'Code.exe' or 'code.exe'. The rule specifically triggers when at least two of these files are found in the specified paths, indicating a potential extension installation.
Detects a specific two-step HTTP pattern characteristic of OysterLoader's initial C2 communication. The malware first sends a registration request containing a 'WordPressAgent' User-Agent string, followed by a login request with a 'FingerPrint' User-Agent string to the same destination. This version checks for the User-Agent strings in the 'AdditionalFields' column.
This rule detects suspicious Python script execution via svchost.exe. Specifically, it looks for svchost.exe processes running from a user's profile directory that execute Python commands containing 'import', 'requests', 'exec(', and a URL (http:// or https://). This pattern is indicative of a Python interpreter being used to download and execute malicious code, potentially masquerading as a legitimate svchost process.
Detects Notepad++ installer and portable files where the file hash does not match a list of known legitimate hashes. This could indicate a malicious file masquerading as Notepad++.
This rule detects the creation or modification of Chrome extension files (.crx) on a device, correlating it with browser extension installation/update events and file prevalence. It flags extensions that are rare, unsigned, small in size, or have suspicious IDs, indicating potential malicious activity or unauthorized installations.
This query identifies outbound network connections made by the notepad++.exe process. This is useful for hunting for suspicious activity, such as connections to malicious update servers or C2 channels, by baselining normal update and plugin activity.
This KQL query identifies file creation events within common Windows startup directories and enriches them with Windows Shell Link (shortcut) creation activity.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Detects file operations involving known malicious hashes associated with a Notepad++ supply chain compromise. The rule identifies files with specific SHA1 hashes and provides contextual information such as action type, device name, file path, and initiating process details. The enhanced version further categorizes risk levels, enriches data with Notepad++ specific context, and aggregates events for a summary view, including threat metrics and prioritization for response actions.
Detects the Notepad++ updater process (GUP.exe) spawning a child process named 'update.exe'. This behavior was observed during the Lotus Blossom supply chain attack where the Notepad++ update infrastructure was compromised to deliver the Chrysalis backdoor.
This rule detects activity related to the Chrysalis Backdoor, which is associated with the Lotus Blossom threat group. It identifies malicious activity through three main components: 1. File and process events matching a list of known malicious SHA256 hashes. 2. Network connections to known malicious IP addresses or domains. 3. Suspicious execution of 'svchost.exe' from non-standard Windows directories with specific command-line arguments, indicating potential masquerading or malicious execution.
Detects the use of curl.exe to upload data to the temp.sh file-sharing service. This technique has been observed in post-compromise reconnaissance activities, including those following Notepad++ compromises.
Page 453 of 509