Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,831 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
9,731
2,539
1,169
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,774
3,899
2,669
2,013
1,826
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects a system shell/interpreter copied or moved into a writable or non-standard path -
the precursor to the 'copy /bin/bash, set SUID, run bash -p' misconfiguration abuse and a
common staging step in the page-cache PoCs. Enriched with source/destination decode, an
inline-SUID-intent flag (chmod +s / chmod 4755 / install -m / setcap in the same command),
masquerade flags (renamed, hidden dotfile, system-lookalike name), a weighted RiskScore /
TriagePriority and DeviceInfo context. Pairs with OS-DET-LNX-006 and correlation
OS-DET-LNX-007. Detection logic adapted from Elastic Security Labs.
the precursor to the 'copy /bin/bash, set SUID, run bash -p' misconfiguration abuse and a
common staging step in the page-cache PoCs. Enriched with source/destination decode, an
inline-SUID-intent flag (chmod +s / chmod 4755 / install -m / setcap in the same command),
masquerade flags (renamed, hidden dotfile, system-lookalike name), a weighted RiskScore /
TriagePriority and DeviceInfo context. Pairs with OS-DET-LNX-006 and correlation
OS-DET-LNX-007. Detection logic adapted from Elastic Security Labs.
Detects a suspicious Microsoft Teams MSI installer (msiexec.exe) spawning a PowerShell child process or referencing a known dead-drop resolver domain. This behavior is indicative of a trojanized installer used as an initial access vector to execute malicious payloads.
Detects PowerShell command execution that combines typical Active Directory or system reconnaissance commands with potential persistence mechanisms, which is a common indicator of post-exploitation activity.
Detects instances where a suspicious PowerShell, mshta, or pwsh command, typically involving download or obfuscation patterns, is launched as a child process of Windows Explorer within two minutes of a modification to the Explorer RunMRU registry key. This behavior is indicative of an adversary attempting to achieve execution, often following user interaction or persistence triggers.
This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy-insecure`, or `--doh-insecure`
which disable TLS certificate validation.
It leverages Cisco Network Visibility Module (NVM) flow data and process arguments
to identify outbound connections initiated by curl where TLS checks were explicitly disabled.
This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints,
a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
which disable TLS certificate validation.
It leverages Cisco Network Visibility Module (NVM) flow data and process arguments
to identify outbound connections initiated by curl where TLS checks were explicitly disabled.
This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints,
a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
Detects the WMI provider host (wmiprvse.exe) spawning common living-off-the-land binaries often associated with command execution or lateral movement.
Detects the ClickFix behavioral pattern where Windows Explorer (typically triggered via the Run dialog) directly spawns PowerShell.exe. This activity is indicative of a user being socially engineered into copying and executing a malicious command from a fake CAPTCHA lure directly into the shell.
Detects evidence of the SLAPSHOT backdoor on Citrix NetScaler appliances by identifying specific ephemeral IPC files (/tmp/.uxdport and /tmp/.uxdlock) or the associated python-based launcher process that uses base64-encoded arguments to initialize the proxy daemon.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit, and PowerShell) to delete Volume Shadow Copies, backup catalogs, or disable system recovery features. This is a common tactic used by ransomware and destructive actors to prevent system recovery.
Detects modifications to Azure DevOps pipelines or service connections that include indicators of outbound tunneling or reverse proxy tools (e.g., ngrok, socat, chisel, or SSH reverse tunnels). This behavior is characteristic of an attacker attempting to establish a command-and-control channel or bypass firewall restrictions by tunneling traffic out of the CI/CD pipeline execution environment.
This rule detects potential command injection attacks targeting the Zimbra 'swatchdog' service, specifically involving the abuse of SNMP trap notifications (CVE-2026-73570). The attack works by injecting malicious shell metacharacters into the 'zimbra-MIB::zmServiceName' argument, which is processed by a Perl-invoked 'swatchdog' script. The rule monitors process execution events for shell commands spawned by the swatchdog utility that contain suspicious shell operators and the targeted MIB parameter.
Detects the execution of '1.bat' when it invokes administrative or sensitive utilities such as schtasks.exe, reg.exe, or specific executables like LockScreenContentServer.exe. This activity is indicative of a persistence mechanism being established or the initiation of a DLL side-loading chain.
Detects the use of standard Linux command-line utilities (e.g., cat, curl, vi) to read or reference sensitive cloud credential files or Kubernetes service account tokens. This behavior is a common indicator of credential theft or discovery activities following initial access to a Linux host.
Detects execution of common script interpreters (mshta, powershell, cmd, wscript) from typical UI-based process launch sources (explorer, RunDlg) when the command line includes indicators of malicious activity such as hidden window flags, obfuscated content, or remote URL downloads. This pattern is characteristic of ClickFix-style social engineering attacks where users are tricked into copying and executing malicious commands.
Detects anomalous process execution and loopback network activity associated with the Model Context Protocol (MCP) 'exec_in_session' method. This pattern indicates an adversary potentially abusing the AI coding assistant's MCP server capabilities to execute arbitrary commands as a C2 channel.
Detects anomalous process execution and loopback network activity associated with the Model Context Protocol (MCP) 'exec_in_session' method. This pattern indicates an adversary potentially abusing the AI coding assistant's MCP server capabilities to execute arbitrary commands as a C2 channel.
Detects a multi-stage process execution chain involving PowerShell: first, a script-based download of remote content, followed by in-memory reflection, and finally, suspicious memory allocation or thread manipulation within the same process context. This pattern is characteristic of fileless malware execution chains designed to evade disk-based detection.
Detects the execution of known tunneling and reverse proxy tools (ngrok, cloudflared, localtunnel) commonly abused by adversaries to create outbound tunnels for C2, bypass firewalls, or exfiltrate data.
Detects the creation of suspicious scheduled tasks using the Windows schtasks.exe utility. The rule flags tasks that are configured to run as SYSTEM, include PowerShell encoded commands, or target directories commonly used for persistence such as Temp, AppData, or Public.
Detects multiple attempts to disable, stop, or tamper with security products, backup solutions, or AV/EDR agents. The rule monitors for malicious use of sc.exe, net.exe, taskkill.exe, and PowerShell cmdlets targeting security software, as well as registry modifications to disable security protections. This behavior is commonly observed in post-compromise stages of ransomware attacks for defense evasion.
Detects suspicious npm preinstall activity or node_modules execution patterns involving the execution of the Bun JavaScript runtime. This behavior is often indicative of supply chain compromise where malicious npm packages attempt to drop and run unauthorized binaries to facilitate secondary payload execution.
Page 25 of 564