Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,427 detections
Filters
Last updated
All Time
Detection languages
8,114
7,121
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,346
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
18,046
3,015
1,489
123
104
Products / Services
5,718
4,275
3,709
1,168
958
MITRE Techniques
9,458
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects process creation events where common Office applications (Word, Excel, PowerPoint, Outlook) or archive/reader utilities (Acrobat, WinRAR, 7-Zip) act as the parent process to command-line interpreters, scripting engines, or administrative tools (such as cmd, powershell, wscript, cscript, mshta, rundll32, and others). This behavior is commonly associated with phishing attacks, macro execution, or exploitation of file formats leading to code execution.
Detects the Shai-Hulud tensorlake payload pattern of fetching a platform-specific HackBrowserData binary and then executing it on the same host to dump browser-stored credentials. Anchored on tool behavior (download then execution on one host) rather than a single sample hash or the rotating C2 domain.
Detects the creation of persistence artifacts associated with the 'gh-token-monitor' service utilized by the Shai-Hulud worm across Linux systemd user services, macOS LaunchAgents, and Windows scheduled tasks or local application directories. This service acts as a dead-man's switch designed to wipe the user's home directory if the stolen GitHub token is revoked.
Detects usage of vssadmin or wmic to delete Volume Shadow Copies
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
Detects the odbcconf LOLBin delivery step assessed for the MuddyWater-linked PatchAgent chain: 'odbcconf /f cloud.rsp' launched from a PatchAgent working directory, typically via a ClickFix lure (explorer -> conhost --headless -> cmd -> odbcconf) fetching the response file over WebDAV. odbcconf executing a .rsp response file is rare in legitimate use and is high-fidelity when paired with WebDAV or a user-writable working directory.
Detects use of wmic to add Microsoft Defender scan exclusions via the
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
Detects post-exploitation activity against Ivanti ICS / Connect Secure
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
Detects data staging and exfiltration preceding Play double extortion: WinRAR/RAR adding files to an archive (recursive or password-protected) followed within 4 hours by a WinSCP transfer from the same host and user.
Detects the execution of known credential theft tools such as Mimikatz, SharpDecryptPwd, and WebBrowserPassView via EDR process creation telemetry.
Detects process execution where a shell (such as bash, zsh, cmd, or powershell) is spawned by a skill or openclaw process, and subsequently performs download activities (e.g., using curl, wget, invoke-webrequest) or establishes persistence (e.g., via cron, systemd, registry run keys, schtasks).
Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.
The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system.
The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches.
Detects MsiExec loading a DLL and calling its DllUnregisterServer function
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
Detects an uncommon svchost parent process
Detects process execution reported by a Smokescreen decoy. A decoy runs no business
workload, so any process beyond the platform's own agent indicates an intruder has
reached the asset and is executing code on it.
Capture the command line in full: on a decoy it is uncontaminated by legitimate
activity and gives a clean view of attacker tooling and intent.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and process != ''
| groupby process, commandline, user, srcip
workload, so any process beyond the platform's own agent indicates an intruder has
reached the asset and is executing code on it.
Capture the command line in full: on a decoy it is uncontaminated by legitimate
activity and gives a clean view of attacker tooling and intent.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and process != ''
| groupby process, commandline, user, srcip
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Page 13 of 973