Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects creation of a scheduled task named "Windows Defender Advanced
Threat Protection Service" configured to run at system startup with SYSTEM privileges
and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact
schtasks command to establish boot persistence for the CoolClient backdoor sideloader,
masquerading the task and binary as a legitimate Windows Defender component.
Threat Protection Service" configured to run at system startup with SYSTEM privileges
and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact
schtasks command to establish boot persistence for the CoolClient backdoor sideloader,
masquerading the task and binary as a legitimate Windows Defender component.
Detects when the IIS worker process (w3wp.exe) spawns common system and network discovery utilities such as whoami, ipconfig, systeminfo, net, and others, which may indicate web shell activity or post-exploitation discovery.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network.
Detects enumeration of local or remote network services.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Detects a process launch whose command line both references a cron persistence path (crontab, /etc/cron.d/, /etc/crontab, /etc/cron.{hourly,daily,weekly,monthly}/, /var/spool/cron/crontabs/) and contains a download-and-execute or reverse-shell marker (curl/wget piped to a shell, /dev/tcp/ redirection, base64-decoded payload, nc -e) or installs the crontab from a file staged under /tmp/. Attackers commonly install a scheduled cron entry so a malicious command re-executes on a fixed interval, surviving reboots and process kills (T1053.003).
Detects the launch of bad-bpf style eBPF rootkit loaders (pidhide with --pid-to-hide, sudoadd with --username) executed via sudo or from an interactive shell parent, representing the userspace step that issues bpf(BPF_PROG_LOAD) before tracepoint hooks go live.
Detects an npm or pip package installation process spawning a script
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
Detects execution of the XMRig Monero cryptominer or a miner
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects a sequence of events on a single device where a shell (/bin/sh, /bin/bash, etc.) is copied to a path involving /usr/bin/dbus-authd using cp or busybox, followed by changing ownership to root, and subsequently setting the SUID permission bit within a 10-minute window.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Page 12 of 974