Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects the execution of suspicious Visual Studio Code extensions, specifically those associated with known malicious extensions like ClawBot. It identifies instances where the VS Code executable initiates a process with command-line arguments containing keywords related to these malicious extensions.
This rule detects the use of unauthorized Remote Monitoring and Management (RMM) tools by identifying network connections to RMM-related URLs that have not been observed in a baseline period (last 7 days) but are observed in the last hour. It specifically filters out connections to approved RMM domains and known initiating processes (like web browsers) to reduce false positives. The rule leverages an external list of RMM domains to identify suspicious activity.
This rule detects network connections to domains and IP addresses associated with the malicious OpenClawCLI campaign, which uses social engineering to trick users into running obfuscated commands.
This rule detects the execution of 'node' with 'install' and 'openclaw' in its command line, or any process command line containing 'https://openclaw.ai/install.'. This indicates an attempt to install or execute the 'openclaw' tool, potentially for malicious purposes or unauthorized software deployment.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detects the execution of Active Directory enumeration tools (ADRecon, ADExplorer) that result in the creation of 'ComputerSPNs.csv'. Muddled Libra uses this file to identify critical services (Veeam, MSSQL, Exchange) for targeting via their Service Principal Names (SPNs).
Detects the execution of a Python interpreter that has been renamed to a common system process name, such as 'svchost.exe'. This is a known TTP used by malware like PXA Stealer to evade detection and blend in with normal system activity. The rule also attempts to correlate this activity with network connections to identify potential C2 communication.
This rule detects network connections or DNS queries to a predefined list of malicious domains. These domains are likely associated with typosquatting or other malicious infrastructure used by adversaries.
Detects EDR suspension attacks using WerFaultSecure.exe to freeze security agents via Windows Error Reporting service, creating detection blind spots for credential dumping or lateral movement
Detects the creation of specific files ('result', 'result.kerb') in common user folders. These filenames are known artifacts of tools like GoSecretsDump used to decrypt the NTDS.dit database, a technique observed in Muddled Libra's playbook after they exfiltrate the database from a Domain Controller.
This detection identifies potential abuse of the Windows Package Manager (winget.exe) for malicious activities, including arbitrary command execution, execution from temporary directories, suspicious network egress, and installation of unsigned binaries from non-admin accounts.
Detects a behavioral pattern associated with CastleLoader's anti-analysis technique, where a process initiates a DNS query that fails (NXDOMAIN) and is immediately followed by a successful network connection to a different destination. This can indicate an attempt to check for sandboxing or sinkholing environments.
This rule detects potential phishing activity by identifying inbound emails from specific sender addresses that were not blocked by Microsoft Defender for Office (MDO), followed by network connections to a known malicious infrastructure associated with 'Tycoon2FA'. The rule first looks for unblocked emails from 'donotreply@docmagic.com' and 'noreply@frigoarrobba.com.br'. If such emails are found, it then checks for network connections to 'listener.facraivo.sa.com' within a 7-day window, indicating a potential compromise or user interaction with the phishing attempt.
This rule detects Office applications (Word, Excel, PowerPoint) or Windows Explorer making outbound WebDAV connections to external, non-private IP addresses on standard web ports (80, 443). This behavior is associated with exploitation of vulnerabilities like CVE-2026-21509, potentially by threat actors such as APT28, to force authentication or exfiltrate data.
Detects suspicious PowerShell execution initiated by explorer.exe, specifically when the command line includes a .lnk file, execution policy bypass, and contains keywords or paths commonly associated with malicious activity (e.g., tor, ssh, github.io, dropbox.com, or suspicious temporary/public directories). This pattern is often observed in initial access or execution phases of attacks.
This detection identifies the execution of a process from a directory that also contains a zero-byte file named 'pic1.png'. This specific behavior is a known execution guardrail for the 'Diaoyu' loader, used by the TGR-STA-1030 group to evade automated sandbox analysis.
Detects the execution of specific Python scripts (modes.py, extentions.py, or udp.pyw) using the silent pythonw.exe interpreter. This activity is associated with the ModeloRAT malware, which is used in the CrashFix campaign, indicating potential persistence or execution of malicious payloads.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key Living Off The Land Binary (LoLBin) technique used in the CrashFix campaign. The detection specifically looks for 'ct.exe' in the command line, the unique 'confirm@' argument indicating a C2 address, and the piping of output to 'cmd' often launched via 'start'.
This rule detects anomalous process executions originating from the SolarWinds Web Help Desk application. It monitors for any child processes spawned by the Web Help Desk application that are not part of a predefined allowlist of expected executables (java.exe, pg_dump.exe, reg.exe, conhost.exe, WerFault.exe) or command lines (mysqldump). This can indicate compromise or misuse of the application to execute arbitrary code.
This rule detects the creation of a zero-byte file named 'pic1.png' followed by the execution of any process from the same directory within a specified time window. This behavior is indicative of the DiaoYu Loader, which uses a zero-byte 'pic1.png' as a guardrail or check before executing its malicious payload.
Detects the use of QEMU with port forwarding (`hostfwd`), a technique observed being used by attackers to create a persistent, virtualized environment for C2 and lateral movement, often via a scheduled task. The rule looks for the creation of scheduled tasks that launch QEMU with port forwarding or the direct execution of QEMU with port forwarding by common parent processes associated with scheduled tasks or remote administration.
Page 454 of 509