Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects non-standard processes (not identified as common web browsers) accessing browser extension configuration files associated with cryptocurrency wallets (MetaMask or Coinbase Wallet). The rule triggers when a process performs file I/O on multiple distinct extension configuration paths, and the initiating process is associated with build-time or package management tools like Node.js, npm, or Git, which may indicate malicious activity related to supply chain attacks or credential theft from browser storage.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
This rule detects the execution of obfuscated PowerShell commands (encoded) that subsequently establish an external network connection and perform process injection within a short timeframe (120 seconds). This behavior is characteristic of malicious staged execution, where a PowerShell script acts as a dropper or loader to fetch secondary payloads and inject them into other processes for evasion.
This rule correlates three suspicious behaviors occurring within 10 minutes: a non-root process identified as 'bumsrakete' executes, this process accesses the sensitive kernel memory file '/dev/mem', and subsequently, a root process is spawned that is not a standard privilege escalation utility (such as sudo, su, etc.). This sequence of events is highly indicative of potential malicious activity, such as kernel-level exploitation or unauthorized privilege escalation.
This rule detects potential supply chain compromise involving typosquatted npm packages. It monitors for the execution of npm packages with names closely resembling legitimate libraries (e.g., 'thirdweb', 'rainbownkit'), followed by suspicious post-install scripts that attempt to initiate network connections to known malicious domains or modify sensitive files.
Detects modifications to Windows Registry Run or RunOnce keys initiated by ConfigurationRemotingServer.exe. This activity is indicative of persistence mechanisms where an executable is registered to launch automatically upon user logon or system startup.
Detects execution of ConfigurationRemotingServer.exe, which is commonly spawned by the Windows Package Manager (winget) or WindowsPackageManagerServer.exe. This activity is part of the Windows package management infrastructure and is identified here to track the usage of these binaries which can be abused to execute commands or manipulate packages.
Detects execution of 'schtasks.exe' spawned by 'ConfigurationRemotingServer.exe'. This pattern is often associated with remote management or administrative tasks, but can be leveraged by adversaries to establish persistence or remote execution.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe to non-internal IP addresses. This process name is often associated with Windows administrative or configuration tools, and unexpected external network communication could indicate unauthorized activity, potential persistence, or command and control (C2) behavior.
Detects a suspicious process execution pattern where 'IntelAudioService.exe' is executed with specific command-line arguments, followed by network connection activity from 'OneDrive.Sync.Service.exe' on the same host within a 2-hour window. This is a common pattern for DLL side-loading to initiate command and control (C2) communication using a legitimate-looking process.
Detects two distinct suspicious activities on Linux systems: masquerading by processes named 'uptime' making outbound network connections to non-local IP ranges, and the execution of binaries associated with AtlasRAT.
Detects suspicious execution of 'ssh', 'sshd', or 'uptime' binaries initiated by web server processes like 'nginx', 'fcgiwrap', or 'uptime'. This behavior often indicates exploitation of a web application to gain remote access or execute unauthorized system commands.
This rule detects the execution of 'gs-netcat' or 'gsocket' utilities, as well as specific configurations of 'smbd' that suggest potential use of network tools for remote command and control or unauthorized access. GSocket allows for the creation of secure reverse shells and peer-to-peer communication channels, which are often used by adversaries to bypass firewall restrictions.
This rule detects successful SSH sessions initiated on Linux systems that are immediately followed by the creation of new executable or script files in common temporary directories such as /tmp, /dev/shm, or /var/tmp. This behavior is indicative of potential post-exploitation activity where an attacker drops tools or malicious scripts after gaining remote access.
Detects execution of schtasks.exe initiated by common scripting languages (wscript, cscript, powershell, pwsh) or execution involving files within the ProgramData directory, which are frequent indicators of malicious activity related to persistence or automated task manipulation.
Detects the execution of network discovery utilities (netstat, tasklist, net) or specific network-related command-line arguments (e.g., session enumeration, netstat flags) when initiated by suspicious parent processes such as fltMC.exe (Filter Manager), or script interpreters like wscript.exe or cscript.exe. This activity is indicative of post-exploitation discovery efforts.
Detects the execution of PowerShell via Command Prompt (cmd.exe) using hidden window arguments to download files from external sources or temporary directories, often associated with stages of malware delivery or post-exploitation activity.
Detects execution of fltMC.exe when located in the Temp directory, or execution of processes matching known malicious file hashes associated with this filename.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects VirtualProtect API calls that change the memory protection of ntdll.dll to PAGE_READWRITE. This behavior is commonly associated with EDR unhooking techniques where malware removes hooks placed by security products to monitor system API calls.
Detects specific registry queries related to 'en-US' custom locale checks, often used by Grixba (Play Ransomware) to identify and evade sandbox environments. The rule also filters for process names matching known Grixba execution patterns or suspicious locations such as Public Music directories.
Page 52 of 100