Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,829 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
9,730
2,538
1,168
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,773
3,899
2,668
2,013
1,825
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects the correlation between the loading of known stealer plugin DLLs outside of standard application paths and subsequent process activity accessing credential stores, sensitive files, or executing wireless key recovery commands.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects when a web browser (such as Chrome, Edge, Firefox, Internet Explorer, Brave, or Opera) spawns common command interpreters, scripting engines, or Living off the Land Binaries (LOLBins) like cmd, powershell, mshta, rundll32, or certutil. This behavior is often indicative of a drive-by compromise or browser exploitation attempt.
The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments.
This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance.
If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.
Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes.
Apply additional filtering as necessary to enhance this.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution details such as process name, parent process, and command-line arguments.
This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance.
If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.
Note that this search does not use a where clause to filter out known benign paths, as NirSoft utilities can be executed from various locations. This might hinder performance in environments with high data volumes.
Apply additional filtering as necessary to enhance this.
Detects service-initiated processes using cryptocurrency mining algorithms, pool configurations, or miner-specific execution parameters.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects shell or interpreter processes spawned as children of the
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
Detects the creation of a Windows scheduled task with the name or command containing 'WinRTCS' correlated with WMI permanent event subscription activities or execution of the 'own_lib.ps1' watchdog script within a 1-hour window on the same device, using Microsoft Defender XDR tables.
Detects potential defense evasion activity where Windows Defender configurations are modified or disabled, followed closely within 20 minutes by a silent, quiet, or unattended software uninstallation initiated by a script interpreter or command processor on the same device.
Detects non-root SSH execution performing remote port forwarding (-R) targeting a Unix socket bind on hosts running the tailscaled daemon, excluding known automation tools.
Detects Tailscale serve commands setting up a TCP forward to a Unix socket (such as tailscaled.sock), correlated with recent file creation, modification, or renaming events involving the socket file by a non-standard process within a 1-hour window.
Detects the execution of tools and commands commonly used to enumerate Group Policy Objects (GPOs) within an environment, such as gpresult.exe with specific flags, PowerShell scripts querying GPO modules, or ldifde.exe checking group policy containers.
Detects potential bootkit activity or unauthorized modifications to the EFI system partition by correlating non-standard .efi file writes with subsequent execution of boot configuration utilities like bcdedit or mountvol within a 30-minute window.
Detects web server processes (such as nginx, apache2, httpd, uwsgi, gunicorn, php-fpm) spawning command-line utilities typically used for system and user discovery (such as id, whoami, groups, hostname, uname, netstat, ps, etc.), which often indicates web application exploitation and remote code execution.
Detects web servers (httpd, apache2, nginx, php-fpm) or Request Tracker (RT) Perl worker processes spawning suspicious child processes such as shells, downloaders, netcat, or Python interpreters, indicative of post-exploitation or web application compromise.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Correlates a running ProFTPD FTP server process listening on TCP port 21 with commands checking or loading the mod_copy module on the same Linux device using Microsoft Defender XDR telemetry.
Detects persistence mechanisms established via Registry Run/RunOnce keys, Startup folder modifications, or scheduled task creation using specific tool names such as client32 or pcictlui.
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Page 8 of 564