Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,439 detections
Filters
Last updated
All Time
Detection languages
8,114
7,133
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
18,057
3,027
1,500
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,459
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects PowerShell execution involving Base64 decoding or certutil decoding combined with writing files to the AppData directory using .NET I/O methods or PowerShell cmdlets.
Detects when common office applications (Word, Excel, PowerPoint, Outlook, OneNote, etc.) or archive utilities/PDF readers spawn command-line interpreters or scripting engines (cmd.exe, powershell.exe, wscript.exe, etc.), which is a common indicator of phishing document execution or malicious archive extraction.
Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.
Detects Windows Terminal or related console hosts spawning PowerShell or PowerShell Core with command-line arguments indicative of staging, downloading, or executing remote scripts (such as encoded commands, Invoke-Expression, or web requests), commonly associated with ClickFix or social engineering techniques.
Detects virtualization management monitor (VMM) processes such as QEMU or Firecracker directly spawning an interactive shell, script interpreter, or network utility as the root user. This behavior is highly anomalous and may indicate a guest-to-host escape leading to remote code execution on the host.
The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
Detects potential data exfiltration activity where a device first exhibits usage of a remote monitoring and management (RMM) tool, followed by the execution of known data transfer or exfiltration utilities such as WinSCP or Rclone.
Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.
Detects the deployment or creation of containers (via Docker, Podman, Nerdctl, Crictl, or Kubectl) with elevated risk flags such as privileged mode, host namespace sharing, root mounts, docker socket access, or initiated from web application parent processes.
Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects the execution of reverse engineering and decompilation tools such as JADX or Blutter against Android APK files or Flutter application binaries (libapp.so), as well as the creation of their typical output artifacts and staging folders.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API
to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.
to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.
Page 10 of 974