Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,764 detections
Filters
Last updated
All Time
Detection languages
3,724
2,041
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,231
485
Categories
5,723
3,080
1,138
901
659
Platforms
9,650
659
432
53
30
Products / Services
10,704
9,764
6,706
4,421
3,752
MITRE Techniques
3,828
3,377
1,982
1,618
1,042
CVEs
18
14
12
12
11
Detects execution of PowerShell processes using the '-w hidden' argument and '-enc' (EncodedCommand) parameter, which is a common technique used by attackers to execute obfuscated code silently.
Detects execution of PowerShell commands using encoded arguments combined with network download cmdlets. This pattern is indicative of a multi-stage loader chain often used in 'ClickFix' style social engineering lures to download and execute secondary malicious payloads.
Detects instances of thread execution where the start module is identified as a critical system component (ntdll.dll or kernel32.dll) but the associated call trace contains 'UNKNOWN' entries. This behavior is indicative of call stack spoofing, a technique used by malicious software to hide the true origin of code execution and evade endpoint security analysis by mimicking legitimate thread start addresses.
Detects access, reading, or modification of sensitive credential files (such as KeePass databases, VPN profiles, private SSH keys, and certificates) by a process. This behavior is often associated with pre-encryption staging for data exfiltration during ransomware attacks.
Detects the execution of PowerShell with hidden window styles and encoded commands that perform common post-exploitation activities, such as remote file downloading or expression evaluation via IEX. This is a common pattern for fileless malware delivery and secondary payload execution.
Detects the Perplexity Comet or Google Chrome browser processes accessing files in locations outside expected directories (such as Downloads, User Data, or Temp), which is a common indicator of a malicious browser extension or process attempting to read arbitrary files from the filesystem.
Detects the execution of a Google Chrome process on a system with a known vulnerability (versions below 143.0.7499.192) in conjunction with browser extension installation or loading activity. This behavior is indicative of the GlicJack exploit (CVE-2026-0628), where a malicious extension attempts to impersonate a trusted AI vendor server to send unauthorized commands to the in-browser AI agent.
Detects mshta.exe spawning suspicious child processes (cmd.exe, powershell.exe, or reg.exe) that are characteristic of the ReverseRAT backdoor. The rule identifies common discovery commands or persistence attempts via Registry Run keys triggered from mshta.exe.
Detects execution of LausivLoader by identifying suspicious process creation patterns typically associated with process hollowing. This includes a parent process (powershell.exe or conhost.exe) launching a child process in a suspended state (CREATE_SUSPENDED), followed by behavioral indicators of memory manipulation and code replacement.
Detects attempts to patch ETW (Event Tracing for Windows) functions such as EtwEventWrite within the memory space of PowerShell or PWSH processes. This is a common technique used by attackers to suppress telemetry and evade security monitoring tools, often associated with bypassing AMSI/ETW logging mechanisms.
Detects attempts to patch ETW (Event Tracing for Windows) functions such as EtwEventWrite within the memory space of PowerShell or PWSH processes. This is a common technique used by attackers to suppress telemetry and evade security monitoring tools, often associated with bypassing AMSI/ETW logging mechanisms.
This rule monitors for suspicious credential-related activity targeting ONVIF interfaces on network devices (such as IP cameras). It detects a pattern where a successful 'global.login' RPC authentication is quickly followed (within 300 seconds) by commands or RPC methods related to credential dumping or user enumeration (e.g., OnvifUser, GetUsers). This sequence is indicative of an adversary using legitimate access to gain unauthorized information from a device.
Detects the creation of a JavaScript file masquerading as a legitimate Microsoft PhotoEngine component ('PhotoStudio.js') within the '%LOCALAPPDATA%' directory. This behavior is associated with the LausivLoader malware, which uses this masquerading technique to evade detection.
This rule detects the LausivLoader initial-stage obfuscated JavaScript dropper. It identifies the malware either by specific file hashes (MD5/SHA256) or by detecting characteristic behaviors: small file size (<1MB), the presence of 'String.fromCharCode' obfuscation techniques, excessive junk comments, and supply-chain related lure strings.
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects instances where wscript.exe spawns conhost.exe with a headless flag, which in turn executes PowerShell with hidden, encoded command-line arguments. This pattern is often indicative of multi-stage malware loaders attempting to obfuscate execution and bypass security monitoring.
This rule detects the execution of processes containing 'OnvifUser' and command line arguments specifying '-u', which is consistent with the usage of ONVIF device discovery tools. ONVIF discovery protocols are used to identify network video transmitters. Unauthorized use of these tools can indicate reconnaissance activity within a network to identify cameras or video surveillance devices.
Detects the creation or renaming of files within the '\ProgramData\doxc' directory, and correlates this with the execution of 'mklink /H' commands that point to that directory. This behavior is indicative of an adversary establishing persistence or hiding files by creating hard links.
Detects the creation or renaming of files within the '\ProgramData\doxc' directory, and correlates this with the execution of 'mklink /H' commands that point to that directory. This behavior is indicative of an adversary establishing persistence or hiding files by creating hard links.
This rule detects unauthorized persistence attempts by monitoring processes (reg.exe or powershell.exe) modifying the Windows 'CurrentVersion\Run' registry key to execute an application named 'DailyFitnessTracker' upon user logon.
Page 81 of 465