Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
714 detections
Filters
Last updated
All Time
Detection languages
330
186
84
42
40
Contributors
240
212
67
64
17
Categories
322
300
90
89
82
Platforms
585
292
181
14
11
Products / Services
10,650
9,755
6,688
4,418
3,745
714
MITRE Techniques
273
233
136
109
85
CVEs
4
4
3
3
2
IDS Classtypes
2
1
Detects a suspicious execution chain where WScript.exe initiates a process with '--headless' arguments, which in turn spawns a PowerShell process with hidden, encoded, and non-interactive command line flags. This pattern is commonly used by adversaries to execute malicious scripts while attempting to evade detection and user interaction.
Detects the execution of JavaScript files using wscript.exe from user-writable directories (e.g., Temp, Downloads, AppData) that exhibit high levels of obfuscation. The rule specifically flags scripts containing a high ratio of comment lines to code, a technique often used in the LausivLoader malware family to mask malicious payloads constructed using String.fromCharCode.
Detects instances where the process 'UBPUpdater.Exe' spawns a process or command line utilizing 'UBPPatch.Psh'. The rule highlights that 'UBPPatch.Psh' is masquerading as a non-executable PowerShell script while likely operating as a malicious binary or PowerShell executable.
This rule detects instances where the Terraform CLI tool connects to suspected lookalike domains associated with supply chain compromise attempts (e.g., hashicorp-aws[.]com or hashicorp-terraform[.]io) during common initialization or application workflows. It correlates process execution with network connection logs and optionally validates the presence of a related .terraform.lock.hcl file associated with the malicious origin.
This rule detects instances where the Terraform CLI tool connects to suspected lookalike domains associated with supply chain compromise attempts (e.g., hashicorp-aws[.]com or hashicorp-terraform[.]io) during common initialization or application workflows. It correlates process execution with network connection logs and optionally validates the presence of a related .terraform.lock.hcl file associated with the malicious origin.
This rule detects potentially malicious activity where a Python-based process or a PyInstaller-compiled executable invokes a command shell (cmd.exe, powershell.exe) or command execution via 'os.popen', followed by a network connection to 'api.telegram.org' within a 60-second window. This behavior is often characteristic of malware or tools using Telegram's API as a command-and-control (C2) channel or for data exfiltration.
Detects unauthorized child processes spawned by ScreenConnect client binaries. The rule specifically looks for files created or modified within 60 seconds prior to execution, which is indicative of attackers leveraging an authentication bypass vulnerability (CVE-2026-84869) to transfer and execute malicious payloads via an active remote access session without requiring additional user interaction or authentication.
Detects the execution of AnyDesk shortly after a Microsoft Teams meeting or call initiation on the same host. This pattern is commonly observed in social engineering attacks where an adversary convinces a user to use remote access software during a live support or phishing call.
This rule detects a multi-stage attack chain targeting a single user within a 2-hour window. It identifies the combination of email bombing (a distraction technique), an incoming external or anonymous Teams call (social engineering channel), and the installation of common remote access tools (e.g., AnyDesk, TeamViewer) on the same host.
Detects the execution of AnyDesk shortly after a Microsoft Teams meeting or call initiation on the same host. This pattern is commonly observed in social engineering attacks where an adversary convinces a user to use remote access software during a live support or phishing call.
This rule detects a multi-stage attack chain targeting a single user within a 2-hour window. It identifies the combination of email bombing (a distraction technique), an incoming external or anonymous Teams call (social engineering channel), and the installation of common remote access tools (e.g., AnyDesk, TeamViewer) on the same host.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects techniques used by SloppyRAT, including indirect NTDLL syscalls bypassing API hooks (Hell's Gate style), and the use of DJB2 API hashing for NtAllocateVirtualMemory and NtCreateThreadEx. It monitors for CallTrace patterns indicating unbacked memory calls into ntdll.dll, detection of hardcoded DJB2 hash constants, or the presence of the B8 (mov eax, imm32) instruction followed by the 0F 05 syscall opcode.
Detects unauthenticated attempts to exploit CVE-2025-3248 in the Langflow 'validate/code' endpoint, characterized by missing authentication headers and the presence of suspicious Base64-encoded payloads or command execution keywords. Additionally, it identifies potential post-exploitation activity where Langflow processes spawn Python subprocesses.
This rule detects processes flagged by SentinelOne's behavioral engine with an 'Evasion' indicator. Specifically, this captures behaviors where a process performs manual module or function export enumeration (such as traversing the PEB Ldr linked list or parsing the EAT) to resolve API addresses, a technique often used to avoid standard dynamic-resolution APIs like LoadLibrary or GetProcAddress in order to bypass EDR API hooking.
This rule detects unauthorized or suspicious processes (like Python scripts or random executables) accessing Telegram Desktop's local 'tdata' directory, which contains user session information, and simultaneously exhibiting network activity directed towards Telegram API domains. This behavior is highly indicative of infostealer activity, where a malicious process attempts to harvest local Telegram session data for exfiltration.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
Page 5 of 34