Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects unauthorized or unexpected processes accessing sensitive local files containing cloud provider credentials, configuration, or environment variables. It identifies access to files such as .aws/credentials, .azure/accessTokens.json, .npmrc, and .env by processes that are not recognized cloud CLI tools. The rule prioritizes alerts involving developer-oriented applications like VS Code or Node.js, which may indicate credential theft or compromise of a developer's workstation environment.
Detects a hidden PowerShell instance collecting hostname, user, domain, operating system, architecture, and security-product information. This behavior is indicative of reconnaissance activities often performed by malware like InstallFix.
This rule detects the creation or modification of a scheduled task that uses 'schtasks', 'powershell', or 'pwsh' to launch an executable from user-writable locations such as Temp, AppData, Public, or ProgramData. The command line specifically looks for references to 'adobe', 'acrobat', or 'onedrive' in conjunction with these user-writable paths, indicating potential abuse of legitimate software for persistence or execution of malicious code.
This rule detects indicators associated with the StegoAd malware family, specifically focusing on suspicious browser extension IDs observed in command-line arguments and network-related process activity (ProcessCreate or NetworkConnect). It monitors for known extension identifiers, StegoAd-specific C2 infrastructure domains, and payload frameworks observed in process command lines.
Detects the use of PowerShell to invoke or interact with 'cloudflared', a tool used to create secure tunnels to Cloudflare. This behavior is often associated with the deployment of malicious infrastructure or remote access tunnels for command and control purposes.
Detects the execution of RustDesk, a legitimate remote access tool, specifically when running with service or tray command-line arguments. This activity may indicate the installation of remote management capabilities by an adversary or authorized administrative activity.
This rule monitors DNS query events to detect internal systems attempting to resolve the domain 'bluegraintours.com', which is indicative of potential command and control (C2) communication or malware activity.
This rule detects potentially malicious activity involving System Informer (formerly Process Hacker) or its associated service (phsvc) spawning suspicious child processes like cmd.exe or using rundll32.exe to execute specific DLL-based proofs-of-concept. These patterns are often associated with privilege escalation or evasion techniques using these tools' service drivers.
Detects the execution of common Linux binary inspection and utility tools (ldd, strings, readelf, objdump, nm) when referencing libssh2, potentially indicating an attacker's reconnaissance effort to analyze libraries for vulnerabilities or reverse engineer SSH-related functionality.
Detects instances where the RustDesk remote access application spawns common system administrative or command-line tools. This behavior is highly indicative of potential abuse of remote desktop software by an attacker to maintain persistent control, execute commands, or perform reconnaissance on a compromised system.
This rule detects the presence of specific file names, paths, or command line arguments associated with a known penetration testing or exploit harness tool (libpwn). These artifacts are indicative of potential security testing or exploit activity on the host.
Detects outbound network traffic from common web browsers (Chrome, Edge, Brave, etc.) to the typosquatted domain 'perplexity-ai.online'. This rule identifies behavior associated with a malicious browser extension ('Search for perplexity ai') that exfiltrates keystrokes and search queries captured via the browser's Omnibox functionality to an attacker-controlled server.
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers.
Detects instances where the OpenVPN Connect process spawns child processes that are not part of the standard OpenVPN installation or common system console hosts like conhost.exe. This pattern is often used to identify when an application is being abused to execute arbitrary commands or malicious payloads.
This rule detects the execution of specific command-line strings and DLL loading associated with Proof-of-Concept (PoC) exploits targeting the System Informer (formerly Process Hacker) kernel driver service (phsvc). These patterns indicate potential attempts to interact with or exploit the driver for unauthorized purposes, such as privilege escalation.
This rule detects the creation, execution, or presence of specific file names and command-line arguments associated with local RCE research, proof-of-concept exploits, and server-side harnesses, specifically identifying artifacts prefixed with 'libpwn_'.
Detects the creation or execution of files associated with the Floci remote code execution (RCE) proof-of-concept tool. It monitors for specific filenames or command-line patterns indicative of this exploit, particularly when spawned from Java-based applications or involving shell command execution.
Detects potential local privilege escalation attempts targeting the SystemInformer PhSvc service. The rule identifies suspicious child processes spawned from rundll32.exe (acting as a proxy) or other common binaries, where the process chain indicates an interaction with the SiSvcApiPort or the use of phsvc-related command-line arguments, potentially leading to unauthorized elevated process creation or service installation.
Detects the creation of files within Windows startup folders originating from a WinRAR process. This behavior is indicative of an adversary using WinRAR to extract or drop malicious persistence items, such as shortcuts (.lnk) or executables, into auto-start locations to maintain persistence across reboots.
Detects the creation of specific file names ('oBKhrQLe1CKmO3RhHO', 'logs.txt', 'ExitCode.txt', 'Key10.txt') within the user AppData Local Temp directory, which is indicative of staging or logging activity by potential malware.
Detects unauthorized access to web browser sensitive files, including credential stores, cookies, and local state files, by processes other than standard browsers or their update mechanisms. This rule also flags access to specific staging directories or archive files associated with known malicious activity.
Page 56 of 100