Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,829 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
9,730
2,538
1,168
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,773
3,899
2,668
2,013
1,825
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects rundll32.exe executing inline JavaScript/VBScript via the
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
Detects attempts to inhibit system recovery by stopping the Volume Shadow Copy Service (VSS) using utilities like net, net1, or sc, or deleting shadow copies using vssadmin.exe, excluding known backup agents.
Detects the correlation of remote execution tools (such as PsExec, WinRM, or specific PowerShell remote execution commands) with RDP or ScreenConnect remote management activity on the same device within a one-hour window, potentially indicating lateral movement or unauthorized remote control.
The following analytic detects the use of the taskkill command in a process command line to terminate several known browser processes, a technique commonly employed by the Braodo stealer malware to steal credentials. By forcefully closing browsers like Chrome, Edge, and Firefox, the malware can unlock files that store sensitive information, such as passwords and login data. This detection focuses on identifying taskkill commands targeting these browsers, signaling malicious intent. Early detection allows security teams to investigate and prevent further credential theft and system compromise.
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.
Detects web server processes (such as apache2, nginx, httpd, php-fpm, or w3wp.exe) spawning shell interpreters (such as bash, sh, cmd.exe, or powershell.exe), which is a common indicator of web shell activity or application exploitation.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Detects web server processes (such as Apache, httpd, or PHP) spawning a Unix shell (sh, bash, dash) and executing discovery commands (such as id, hostname, uname) with output redirection to proof files or embedded in callback URLs via command substitution.
Detects Chromium-based browsers launched with remote debugging port 9222 or execution of chrome-decryptor tooling by Python processes, indicative of credential theft or Chrome CDP cookie extraction (such as Armorsteal).
Detects operator synchronization scripts (sync-all.sh, sync-memory.sh, sync-cc-users.sh) spawning SSH, rsync, or scp commands targeting AI-named jump-server accounts (claude, grok, gemini, glm).
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Detects modifications to the Tor configuration file (torrc) that permit SSH traffic (port 22) in the exit policy, followed by a Tor service reload or restart on the same device within a 4-hour window. This behavior may indicate an adversary setting up an onion routing proxy or covert tunnel.
Detects PowerShell being launched directly from the Windows Run dialog
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects cmd.exe executing a ping-based delay to loopback followed by self-deletion of the batch script (%~f0), as well as bulk deletion of common archive and executable files, typically associated with malware droppers like RareWolf.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects the modification or setting of the execInstalledOnly parameter to false, 0, or disabled on VMware ESXi or Linux hosts via process execution command lines or syslog messages, often associated with running uninstalled or arbitrary scripts/binaries in virtualized environments.
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Detects command output staged in a temporary file (/tmp/nx_cmd.txt) by a Unix shell spawned from ExifTool or Perl, typically resulting from Gotenberg CVE-2026-42589 exploitation, or detects the specific staging filename behavior independently.
Detects indicators of ToolShell web shell creation (spinstall0.aspx) and ASP.NET machine key harvesting activities (reading web.config or accessing validationkey/decryptionkey materials via w3wp child processes or file access audits) on SharePoint servers.
Page 6 of 564