Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,697
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects a Node.js process spawning a detached, hidden child node.exe process from within a node_modules directory, a technique observed in the indexed-btree npm supply-chain malware to establish a stealthy runtime loader.
Detects persistence attempts using Component Object Model (COM) hijacking by modifying HKCU CLSID InProcServer32 registry keys. The rule specifically identifies instances where the registry value points to a DLL file located within the user's AppData or LocalAppData directories, excluding typical system or program directories, as seen in sideloading persistence chains.
Detects the execution of the AnyDesk installer when triggered by a process spawned from common web browsers. This pattern is often observed when users download and execute remote access software from the internet.
Detects the modification of InProcServer32 registry keys within the user's Classes/CLSID hive to point to a file located in the AppData directory. This pattern is commonly used for COM hijacking to achieve persistence or execute arbitrary code under the user's context.
Detects the execution of 'wkspbroker.exe' or the loading of 'radcui.dll' from a non-standard, user-writable directory path ('AppData\Local\Microsoft\RemoteApp\Gateway'). This behavior is indicative of DLL sideloading or execution of potentially malicious or unauthorized binaries masquerading as legitimate Windows remote connectivity components.
Detects the execution of AnyDesk shortly after a Microsoft Teams meeting or call initiation on the same host. This pattern is commonly observed in social engineering attacks where an adversary convinces a user to use remote access software during a live support or phishing call.
Detects the execution of AnyDesk shortly after a Microsoft Teams meeting or call initiation on the same host. This pattern is commonly observed in social engineering attacks where an adversary convinces a user to use remote access software during a live support or phishing call.
This rule monitors for suspicious Node.js process activity, specifically focusing on the loading of scripts associated with obfuscated or malicious packages (e.g., sharedLoad.min.js, indexed-btree) and the use of child_process spawn patterns that indicate detached, hidden, or unreferenced child processes, which are common tactics for bypassing detection or maintaining stealthy execution.
Detects known malicious files associated with Kimsuky (APT-C-55) Stella_Gary attack chain by MD5 hash: OrionQuests-Setup.exe installer, guide.url.lnk, test.bef_fri, and backdoor payload component
Detects known malicious files associated with Kimsuky (APT-C-55) Stella_Gary attack chain by MD5 hash: OrionQuests-Setup.exe installer, guide.url.lnk, test.bef_fri, and backdoor payload component
This rule detects the creation of specific shortcut files (.lnk) within the Windows Startup folder and monitors for the usage of WScript.Shell to interact with the Startup directory. This behavior is commonly associated with persistence mechanisms where an adversary attempts to automatically execute malicious code upon user login.
Detects a git checkout to a specific SHA followed by a git rev-parse HEAD verification command within AI coding assistant plugin directories (e.g., claude, codex, copilot, gemini). This pattern is monitored to identify potential supply chain compromises where a working tree might be silently substituted during plugin installation or updates.
Detects instances where Windows Explorer (explorer.exe) spawns PowerShell with heavily obfuscated command lines, characterized by caret-obfuscation and execution policy bypass flags. This pattern is characteristic of ClickFix social engineering, where a user is tricked into pasting malicious commands into the Windows Run dialog.
Detects the execution of git-related operations (fetch, pull, clone) as child processes of common AI coding agent binaries. This pattern is indicative of potential unattended or malicious background plugin auto-updates, which could be leveraged for 'Plugin4Shell' style zero-click plugin distribution attacks.
Detects the execution of the Windows cipher.exe utility with the /w flag, which is used to overwrite deleted data on a disk to prevent forensic recovery. This is a common technique used by adversaries to perform data destruction or cover their tracks.
Detects known PowerShell dropper and embedded StealC payload binaries used in the ClickFix infection chain via exact SHA256 hash equality only
Detects known PowerShell dropper and embedded StealC payload binaries used in the ClickFix infection chain via exact SHA256 hash equality only
Detects the execution of binaries or scripts named with keywords related to AI agent plugins (e.g., 'skill', 'plugin', 'mcp-server') from potentially untrusted locations like Downloads or Temp folders. The rule further correlates this execution with post-exploitation indicators such as persistence establishment (registry keys, scheduled tasks, launch agents) or outbound network activity.
Detects a rapid, multi-stage intrusion sequence on a single host involving discovery, lateral movement, and high-volume file modifications. The rule identifies anomalous behavior where diverse reconnaissance and lateral movement commands are executed within a compressed timeframe, characteristic of automated or LLM-driven orchestration of ransomware operations.
Detects the installation of AI agent-related packages (npm, pip, etc.) followed shortly by unauthorized access to sensitive files or credential stores on the same host. This pattern is indicative of a malicious or 'poisoned' AI agent tool performing credential theft or unauthorized exfiltration of sensitive system data.
This rule detects potential unauthorized use of MeshAgent RMM software by correlating process execution events (mvtcs.exe, MeshAgent) with network traffic to specific IP addresses identified as associated with Settra command-and-control infrastructure. It specifically filters for MeshAgent activity and validates the threat by requiring an established network connection to known malicious endpoints.
Page 78 of 465