Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects instances where a parent Node.js process spawns a child Node.js process using a command line structure often associated with malicious npm packages. These packages frequently attempt to execute loader scripts in a detached or background manner to evade detection while maintaining persistence or performing malicious operations.
Detects the presence of file artifacts associated with the Xray-core proxy tool when used as an implant via DLL sideloading. The rule identifies specific files (radcui.dll, config.json, comsrv.dat, KB85809588.bat) or malicious configuration patterns indicating proxy traffic (VLESS/VMess/outbound/inbound) targeting known C2 endpoints.
This rule detects the execution of AnyDesk within a 30-minute window of Microsoft Teams activity on the same device. This pattern is indicative of a vishing attack, where a malicious actor lures a victim into installing remote access software during a fake technical support session initiated via Teams.
Detects the modification of InProcServer32 registry keys within the user's Classes/CLSID hive to point to a file located in the AppData directory. This pattern is commonly used for COM hijacking to achieve persistence or execute arbitrary code under the user's context.
Detects the loading of wkspbroker.exe or radcui.dll modules from the Microsoft RemoteApp Gateway directory located within the user's AppData path. This behavior may indicate an attempt to utilize or manipulate Remote Desktop components from a non-standard or user-writable location.
Detects the invocation of Windows Subsystem for Linux (WSL) binaries (wsl.exe or wslconfig.exe) using command-line arguments that enable arbitrary command execution, such as -e, --exec, or shell interpreters (bash -c, sh -c), or web-based retrieval tools like curl/wget. This technique is often used to execute commands or download payloads within a Linux environment on Windows, potentially bypassing security controls focused on native Windows processes.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
Detects network connections to known SideCopy/ReverseRAT command-and-control infrastructure, including a static C2 IP address and two C2/hosting domains (matched exactly and as proper subdomains to avoid substring false positives).
Detects mshta.exe spawning suspicious child processes (cmd.exe, powershell.exe, or reg.exe) that are characteristic of the ReverseRAT backdoor. The rule identifies common discovery commands or persistence attempts via Registry Run keys triggered from mshta.exe.
Detects the use of certutil.exe to add a certificate to the root store. Adversaries may perform this action to establish persistence or facilitate interception of encrypted traffic by adding a malicious CA certificate to the trusted root store.
Detects the indexed-btree npm malware loader embedded in BTree.prototype.set that spawns a detached hidden Node.js child process and references sharedLoad.min.js
Detects the creation or modification of registry entries within the 'HKCU\...\Run' hive that point to executables located in suspicious or atypical directories such as 'ProgramData', 'Users\All Users', or specific non-standard application paths often used by malware for persistence.
Detects the execution of binaries masquerading as legitimate software (such as KeePass, Adobe Flash, or specialized medical document viewers) from user-writable and non-standard execution paths (e.g., Downloads, Temp). This behavior is characteristic of the CHOSEN BRICK malware's lure-execution stage, where users are socially engineered into running a decoy installer.
Detects the use of built-in Windows utilities and commands to disable system recovery features, delete volume shadow copies, clear backup catalogs, or perform mass file deletion. This behavior is highly indicative of wiper malware preparing for a destructive attack by preventing system recovery.
Detects the execution of PowerShell with encoded commands originating from scripting engines wscript.exe or cscript.exe. The command line contains indicators of malicious activity such as references to external domains, archive expansion, or specific executable payloads.
Detects Microsoft Edge executable (msedge.exe) being created, deleted, or renamed within the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This path is often used by adversaries to masquerade malicious files or persistence mechanisms as legitimate telemetry components.
Detects the Microsoft Edge browser executable running from an anomalous path (C:\ProgramData\Microsoft\Windows\Telemetry\) or exhibiting suspicious network behavior (to a known malicious domain 'deadhub.org' or IP address '193.23.118.155'). This behavior is indicative of a masquerading attempt to hide malicious activity by mimicking a trusted browser binary.
Detects modifications to HKEY_CURRENT_USER Run keys associated with the HEAVYGRAM backdoor, which uses specific filenames and patterns to establish persistence via autorun registry entries.
Detects the creation of a scheduled task named 'OneDrive KeepAlive' or a task set to execute every 5 minutes, in conjunction with the execution of 'taskhostw.exe' containing 'exec hide' in its command line. This pattern is indicative of the Kimsuky threat group using a renamed version of the NirCmd utility to maintain persistence and execute commands silently.
Detects the suspicious copying of the Windows certutil.exe binary to an alternate location (e.g., /Users/Public/Downloads/) followed by execution with decoding or caching flags. This behavior is indicative of an adversary attempting to use certutil as a LOLBin to decode or reassemble malicious payloads, a tactic frequently observed in Kimsuky-related LNK malware campaigns.
Page 72 of 465