Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,829 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
9,730
2,538
1,168
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,773
3,899
2,668
2,013
1,825
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects a sequence where a SharePoint application pool worker process (w3wp.exe) spawns a command shell (cmd.exe, powershell.exe, pwsh.exe) related to SharePoint, followed shortly (within 1 hour) by high-fidelity lateral movement tooling or remote execution techniques (such as PsExec, WMI, PowerShell remoting, or scheduled tasks) on the same host.
Detects the execution of built-in Windows utilities such as vssadmin, wmic, wbadmin, and bcdedit performing recovery inhibition actions, including deleting volume shadow copies, resizing shadow storage, clearing the backup catalog, disabling recovery options, and configuring boot policies to ignore failures.
Detects a web browser spawning a script interpreter or dual-use
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
Detects outbound network connections to known ClickFix campaign domains or the execution of the finger utility connecting to public IP addresses.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects a web server process (apache2, httpd, php-fpm) spawning a Unix shell (dash/sh) that executes discovery commands such as id, whoami, hostname, or find. This is the durable post-exploitation signature of the wp2shell WordPress pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137), where a malicious plugin or webshell executes commands through the web stack.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects suspicious command execution activities using Azure RunCommand, Custom Script Extension, or Azure Connected Machine Agent combined with potentially malicious command arguments or tools such as PowerShell encoded commands, 'IEX', download strings, certutil, whoami, base64, curl, or wget.
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
Detects a sequence of events on a Linux device where a sudo command execution is followed within 15 minutes by a Perl process executing base64 decoding commands within the same SSH session.
Detects shadow copy destruction and recovery feature tampering used
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
Detects an AhsayCBS / Tomcat / Java web service process spawning a
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
Detects AI coding assistants and agents (such as Copilot, Cursor, Claude Code, etc.) spawning command-line interpreters (PowerShell, CMD, Node, Bun, Deno) with potential API keys, tokens, or credentials exposed in the process command line.
Page 7 of 564