Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager
Detects non-browser clients or runtimes (such as curl, python, node, or Electron-based apps) successfully connecting to or referencing compromised eMudhra certificate status checker hosts, indicating systems that still trust compromised intermediate certificates.
Detects PHP fatal out-of-memory errors reported in Unknown on line 0, indicating a memory exhaustion bailout before request initialization (pre-RINIT), associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal). If log_errors is Off, or FPM runs with fastcgi.logging Off and catch_workers_output no, the line is never written.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects instances where rundll32.exe is executed with no arguments or minimal arguments, matching the typical Cobalt Strike spawn-to sacrificial process behavior. Aggregated per device, account, and parent process.
Detects remote thread creation (CreateRemoteThreadApiCall) where the source process is an Office application, browser, or script host, and the target process is a critical system binary such as rundll32.exe, svchost.exe, or explorer.exe.
Detects PHP error log entries indicating a session object decode failure, which may indicate exploitation attempts of CVE-2026-109618 and CVE-2026-109619. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal).
Detects when the Internet Information Services (IIS) worker process (w3wp.exe) spawns suspicious child processes, command interpreters, or reconnaissance utilities, which may indicate web shell activity, remote code execution (RCE) via ViewState deserialization, or other web application exploitation.
Detects a behavioral sequence where a signed process loads an unsigned DLL from a user-writable path (DLL sideloading) followed shortly by outbound HTTPS network connections from the same process to legitimate cloud storage or API infrastructure.
Detects process injection targeting a web browser process.
Amatera and comparable infostealers inject into trusted browser processes
such as Chrome, Edge, Brave and Firefox to evade detection and access
credential and cookie data in memory.
Amatera and comparable infostealers inject into trusted browser processes
such as Chrome, Edge, Brave and Firefox to evade detection and access
credential and cookie data in memory.
Detects the correlation of a file creation event in the user Temp folder (such as t.vbs) originating from browser cache or download patterns, followed shortly by the execution of the script via wscript.exe or cscript.exe.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.
Detects rundll32.exe being invoked either:
(a) against a file with a non-DLL/non-executable extension (e.g. .jpg, .png, .pdf,
.txt, .ini, .html, .js) followed by an exported function call — a common evasion
where a malicious DLL is renamed to a benign extension to bypass extension-based
filtering, or
(b) from a user-writable staging directory (Temp, AppData, ProgramData, Public,
Downloads) — a broader signal since legitimate rundll32 targets are almost
always shipped under Program Files/System32, not dropped into user-writable
paths at runtime.
Excludes cases where the parent process is msiexec.exe, since MSI custom actions
legitimately spawn rundll32 against .tmp/.dat staging files during installation.
(a) against a file with a non-DLL/non-executable extension (e.g. .jpg, .png, .pdf,
.txt, .ini, .html, .js) followed by an exported function call — a common evasion
where a malicious DLL is renamed to a benign extension to bypass extension-based
filtering, or
(b) from a user-writable staging directory (Temp, AppData, ProgramData, Public,
Downloads) — a broader signal since legitimate rundll32 targets are almost
always shipped under Program Files/System32, not dropped into user-writable
paths at runtime.
Excludes cases where the parent process is msiexec.exe, since MSI custom actions
legitimately spawn rundll32 against .tmp/.dat staging files during installation.
The following analytic detects a Chromium-based browser being launched with both the --hide-crash-restore-bubble and --restore-last-session
command-line flags by a process other than the browser itself. Focusing on browser command lines that silently restore the previous session
without showing the "Chrome didn't shut down correctly" notification. This activity is significant because browser hijackers and adware droppers
forcefully terminate the browser to tamper with its preference files, then relaunch it with these flags so that the victim does not notice the
interruption and lands on an attacker-controlled page. If confirmed malicious, this could indicate that the browser profile was modified to
hijack the default search engine, new tab page or to side-load a malicious extension.
command-line flags by a process other than the browser itself. Focusing on browser command lines that silently restore the previous session
without showing the "Chrome didn't shut down correctly" notification. This activity is significant because browser hijackers and adware droppers
forcefully terminate the browser to tamper with its preference files, then relaunch it with these flags so that the victim does not notice the
interruption and lands on an attacker-controlled page. If confirmed malicious, this could indicate that the browser profile was modified to
hijack the default search engine, new tab page or to side-load a malicious extension.
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Detects execution of a specific PowerShell remediation script using execution policy bypass, or generic PowerShell activity importing certificates into the LocalMachine\Disallowed store outside of known administrator processes and accounts.
Detects host reconnaissance activities (such as whoami or systeminfo) executed via Remote Monitoring and Management (RMM) tools or accompanied by suspicious PowerShell download and execution activity within a specific time window.
Detects Active Directory Certificate Services (AD CS) certificate issuance events (Event ID 4887) where the user requesting the certificate differs from the Subject Alternative Name (SAN) identity supplied in the request. This behavior is indicative of ESC1-style AD CS privilege escalation abuse, where a user requests a certificate on behalf of another privileged user.
Detects multiple distinct discovery commands (such as ipconfig, tasklist, or system version registry queries) executed via cmd.exe spawned from a parent process located in an AppData Roaming KB directory within a 30-minute window.
Page 8 of 1907