Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects bash processes executing commands that combine AWS identity verification with outbound exfiltration using curl. The pattern specifically monitors for the use of 'aws sts get-caller-identity' followed by an immediate HTTP POST transmission of data (indicated by '-d @-'), which is characteristic of attackers exfiltrating captured cloud environment metadata or temporary credentials.
Detects the execution of 'aws sts get-caller-identity' by common IDEs or code editor helper processes. This activity is often used by adversaries to verify the current AWS identity and permissions after gaining access to a developer's workstation.
Detects the use of Node.js package managers (npm, node, npx) to execute 'install' commands in conjunction with the creation of specific Model Context Protocol (MCP) configuration files (.vscode/mcp.json, .amazonq/mcp.json, or .cursor/mcp.json). This pattern may indicate the installation of potentially untrusted or malicious development extensions or AI-assistant integrations within common development environments.
This rule detects processes running from suspicious temporary directories (AppData, Temp, LocalAppData, TCC) initiating frequent outbound network connections to a specific non-standard destination port (18848). This behavior is often indicative of automated Command and Control (C2) heartbeats or beacons, particularly when associated with binaries executing from untrusted or user-writeable locations.
Detects the execution of Lua interpreter binaries (LuaJit or lua) spawned from a specific process named 'HFY.exe', which is associated with the BeepRAT dropper. The rule also correlates this execution with suspicious raw disk read activity to identify potential in-memory payload loading or malicious interaction with system files.
This rule detects potentially malicious activity involving the AnyDesk remote access tool by monitoring for abnormal child process spawning, such as command shells (cmd, powershell, etc.), and suspicious DLL loading behavior from non-standard directories. These activities are common indicators of an adversary using remote desktop software for command and control or post-exploitation execution.
Detects when Minecraft-related clients (e.g., Lunar Client, generic Java Minecraft) launch suspicious child processes such as command-line utilities (cmd.exe, powershell.exe, curl.exe) often associated with malicious post-exploitation activity or credential harvesting.
Detects instances where the AnyDesk remote support application spawns suspicious child processes or administrative utilities. This rule specifically alerts on AnyDesk launching interpreters such as PowerShell, CMD, WScript, or utility binaries like dllhost, regsvr32, mshta, and rundll32, or when processes are executed in the context of the SYSTEM account (UserSid S-1-5-18). Such behavior is a common indicator of unauthorized remote access or post-exploitation activity.
Detects network activity associated with Djinn Stealer malware, identifying either direct connections to a known command-and-control (C2) server or HTTP exfiltration attempts using a characteristic User-Agent string and binary content type.
Detects anomalous activity associated with the 'SmartWindow' browser exploitation technique, specifically: Firefox communicating with the local SmartWindow PoC C2 API on port 8765, Firefox spawning unexpected child processes, or unauthorized processes accessing Firefox's 'places.sqlite' database to harvest browsing history or private session data.
Detects the use of the Windows attrib.exe utility to modify file attributes, specifically targeting the addition of hidden (+h) or system (+s) attributes. The rule looks for these modifications in suspicious locations or contexts, such as ProgramData, IDM log directories, or in association with specific application filenames, which may indicate attempts to hide malicious files or persistence mechanisms.
This rule detects the creation of scheduled tasks or registry run keys that contain suspicious path indicators or specific file names often associated with persistence mechanisms. It monitors for the use of 'schtasks.exe' or 'at.exe' to create tasks referencing paths like ProgramData, Temp, AppData, or IDM\logs, as well as modifications to the 'Run' registry key with similar suspicious values.
Detects suspicious network-related activity initiated by common command-line utilities when spawned as child processes of Visual Studio Code (Code.exe). This pattern is often indicative of automated script execution, malware staging, or adversary activity following code repository manipulation, particularly when preceded by a git clone operation within a 15-minute window.
Detects specific suspicious processes (MediumInstStart.exe or pcl2bmp.exe) initiating network connections or DNS requests to identified malicious IP addresses (188.208.141.177) or domains (couldinstallup.com, workdrive.zoho.com, zohoapis.com) within a one-hour window. These processes are indicative of potential malware or unauthorized C2 activity.
Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.
Detects suspicious command-line execution of cmd.exe involving specific patterns like 'MiniJunk' or 'MiniBrowse', or command-line activity spawned from common file types (e.g., .exe, .doc, .pdf, .zip). This rule is designed to identify potential multi-stage payload execution or malicious dropper activity associated with the UNC1549 threat actor.
This rule detects the execution of specific shell processes (sh, bash, crontab) where command-line arguments reference suspicious paths commonly associated with persistence mechanisms or malware, such as /var/tmp/ files or crontab spool directories.
This rule monitors network traffic for DNS queries directed at domains associated with known malicious browser extensions, specifically targeting Adblock for YouTube and Adblock for Chrome malicious variants. It correlates these connections with process command line evidence that matches the extension IDs of these malicious components.
Detects command-line execution of 'rm' or 'cp -a' targeting specific sensitive system, credential, or configuration files on Linux systems. This behavior often indicates an attempt to remove evidence, destroy logs, or stage sensitive data for exfiltration.
Detects execution of sensitive administrative binaries (rm, chmod, chown) targeting critical system files or directories, or direct interaction with sensitive system files and configuration logs which may indicate unauthorized data access or evidence tampering.
Detects execution of EDRChoker, a tool designed to impair EDR telemetry, when it is passed a process list text file as an argument. The rule specifically looks for command lines containing 'list.txt', an executable name (e.g., 'tool.exe'), and the string 'edr'.
Page 48 of 100