Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects host reconnaissance activities (such as whoami or systeminfo) executed via Remote Monitoring and Management (RMM) tools or accompanied by suspicious PowerShell download and execution activity within a specific time window.
Detects Active Directory Certificate Services (AD CS) certificate issuance events (Event ID 4887) where the user requesting the certificate differs from the Subject Alternative Name (SAN) identity supplied in the request. This behavior is indicative of ESC1-style AD CS privilege escalation abuse, where a user requests a certificate on behalf of another privileged user.
Detects instances where Setup.exe loads the winmm.dll module from the same non-system directory located in user-writable paths (such as Users, Downloads, AppData, Temp, or ProgramData), which is indicative of DLL hijacking or side-loading activity.
Detects a Run/RunOnce registry value whose data points to an
executable or script in a user-writable location (AppData, Temp, ProgramData,
Users\\Public). Amatera establishes persistence by adding Run key entries that
relaunch the stealer on user logon.
executable or script in a user-writable location (AppData, Temp, ProgramData,
Users\\Public). Amatera establishes persistence by adding Run key entries that
relaunch the stealer on user logon.
Detects a file creation event for any executable inside the "tmphtml" staging
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.
Detects a file creation event for any executable inside the "tmphtml" staging
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
Detects inbound network connections from known IP addresses associated with PHP2Shell exploitation attempts and malicious tooling infrastructure.
Detects the execution of two or more distinct Active Directory discovery, credential extraction, or coercion tools (such as NetExec, Kerbrute, noPac, PetitPotam, SoftPerfect Network Scanner, or Impacket scripts) on the same device within a 1-hour window.
Detects behavior where PowerShell or pwsh executes msiexec.exe to silently install an MSI file located in a temporary directory with a GUID-prefixed filename, optionally following a recent download from a remote URL.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects the sequence where a private key file is written to the host followed by the execution of ssh.exe with parameters indicating a reverse port forwarding tunnel (-R), an identity file (-i), and background execution (-N or -f) within a 30-minute window.
The KQL rule detects a ClickFix-style technique in which script hosts reference files disguised with an f_* naming pattern in browser profile cache directories. The key behavioural indicators are:
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects the execution of the rclone.exe utility with copy, sync, move, or copyto command-line arguments, correlated with outbound network connections to Wasabi S3 or MEGA cloud storage domains.
Detects process command lines containing Magento database audit strings (cms_block, cms_page) alongside specific loader domains, or network events communicating with these known loader domains.
Page 9 of 1907