Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,085 detections
Filters
Last updated
All Time
Detection languages
937
669
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
208
171
Platforms
1,854
491
298
26
12
Products / Services
10,665
9,758
6,693
4,421
3,749
2,085
MITRE Techniques
760
704
336
308
238
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects suspicious activity involving Docker containers, specifically focusing on path traversal attempts via the 'docker cp' command, execution of potential proof-of-concept scripts, or the creation of specific marker files indicating attempts to interact with or escape from the containerized environment to the underlying host.
This rule detects activities associated with a specific malicious browser extension, including the presence of its files on disk, execution of browsers with the extension ID in the command line, and network connections to known malicious or typosquatted domains (perplexity-ai.online, extension.tilda.ws) used for C2 or exfiltration.
This rule detects suspicious command-line activity where shell interpreters (bash, sh, dash, python) are used to search for or interact with potentially sensitive system files, such as password files or custom indicators of compromise like 'evil_tenant'. The query targets grep, find, ls, and echo commands used to locate or confirm the existence of these sensitive artifacts.
Detects network connections originating from standard web browsers (Chrome, Edge, Brave, Chromium, Opera) to the domain 'perplexity-ai.online', which is indicative of potential command and control or unauthorized data exfiltration activity.
Detects the execution of common Linux administrative, network, and system information gathering commands, often associated with reconnaissance activity by an adversary after gaining shell access.
Detects the execution of known analysis or command-line tools by AnyDesk, a legitimate remote access tool. This pattern is often observed during post-exploitation activities where an attacker uses authorized remote access tools to execute further commands or deploy diagnostic tools on the compromised host.
This rule detects DNS requests initiated by common web browsers (chrome, msedge, brave, chromium) to a known malicious domain 'perplexity-ai.online', which is often indicative of C2 callback activity.
This rule identifies the execution or presence of a specific malicious installer executable (MD5 87603EA025623B19954E460ADD532048) that is known to be reused and renamed across multiple campaigns to masquerade as legitimate software installers.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects instances where specific DLLs known to be abused in malicious contexts (libwebp.dll, mingwm10.dll, libffi-6.dll, libpng15.dll) are loaded by common productivity and scripting processes, such as Microsoft Office applications (Word, Excel, Outlook) or scripting engines (wscript.exe, mshta.exe). This pattern is often indicative of side-loading or exploitation of malicious documents and scripts.
This rule detects process execution where the command line contains specific strings commonly associated with process debugging, environment analysis, or exception handling (e.g., 'RtlGetCurrentPeb', 'timeBeginPeriod', 'gcstoptheworld', 'trace/breakpoint trap'). These artifacts are frequently observed in security research tools, malware analysis frameworks, or during the development of exploit payloads designed to interact with process memory or handle execution flow interruptions.
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
Detects execution of PowerShell or PWSH containing multiple suspicious command line flags commonly associated with malicious scripts and evasion techniques, such as bypassing execution policies, running in hidden windows, using encoded commands, or utilizing invoke-expression.
Detects the use of the legacy OSQL.exe utility to connect to a local SQL server instance and execute a query that writes output to a file. This behavior is indicative of manual data discovery or exfiltration from a local database.
This rule detects instances where the IIS web server process (w3wp.exe) spawns common command-line interpreters such as cmd.exe or powershell.exe. This activity is a classic indicator of a successful web application exploit, potentially leading to remote code execution.
Detects the execution of a process named 'packet_edit_meme' on Linux systems, which is often indicative of specific malware or unauthorized tool usage.
This rule detects pre-payload beaconing activity associated with the Meow RAT malware. It covers both network-based detection (outbound HTTP POST to known C2 domains and paths) and endpoint-based detection. Endpoint detection includes 'curl' processes communicating with known C2 infrastructure, 'osascript' processes spawned in the context of 'curl' C2 communication, and 'curl' commands using specific flags ('-k', '-s') along with a known build hash. This activity typically occurs before the main destructive payload is delivered.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
Detects attempts to terminate security-related processes or stop security-related services using common administrative tools like taskkill.exe, sc.exe, net.exe, or net1.exe. This activity is often indicative of an adversary attempting to disable security monitoring and protection software to facilitate further malicious actions.
Detects instances where known endpoint security product binaries (EDR/AV) load DLL files from directories outside of their trusted, standard installation paths. This behavior is a common indicator of DLL sideloading, where an attacker attempts to masquerade malicious code as a component of a trusted security process to evade detection.
Hunting rule for nmap used for internal network discovery.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Page 49 of 100