Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects use of wmic to add Microsoft Defender scan exclusions via the
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
Detects post-exploitation activity against Ivanti ICS / Connect Secure
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
Detects data staging and exfiltration preceding Play double extortion: WinRAR/RAR adding files to an archive (recursive or password-protected) followed within 4 hours by a WinSCP transfer from the same host and user.
Detects the execution of known credential theft tools such as Mimikatz, SharpDecryptPwd, and WebBrowserPassView via EDR process creation telemetry.
Detects process execution where a shell (such as bash, zsh, cmd, or powershell) is spawned by a skill or openclaw process, and subsequently performs download activities (e.g., using curl, wget, invoke-webrequest) or establishes persistence (e.g., via cron, systemd, registry run keys, schtasks).
Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.
The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system.
The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches.
Detects MsiExec loading a DLL and calling its DllUnregisterServer function
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
Detects an uncommon svchost parent process
Detects process execution reported by a Smokescreen decoy. A decoy runs no business
workload, so any process beyond the platform's own agent indicates an intruder has
reached the asset and is executing code on it.
Capture the command line in full: on a decoy it is uncontaminated by legitimate
activity and gives a clean view of attacker tooling and intent.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and process != ''
| groupby process, commandline, user, srcip
workload, so any process beyond the platform's own agent indicates an intruder has
reached the asset and is executing code on it.
Capture the command line in full: on a decoy it is uncontaminated by legitimate
activity and gives a clean view of attacker tooling and intent.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and process != ''
| groupby process, commandline, user, srcip
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects suspicious command-line execution patterns involving Unix shells (bash, zsh, sh) spawned from terminal applications where tools like curl or wget are piped directly into a shell, base64 decoding is performed, osascript executes dialogs, or quarantine attributes are removed.
Detects the use of msxsl.exe or wmic.exe to process .xsl or .xslt files, potentially indicating the execution of embedded scripts. The rule calculates a risk score based on the combination of the utility name, the presence of an XSL/XSLT file reference in the command line, usage of suspicious file paths (e.g., Temp, AppData), and being launched by potentially suspicious parent processes like cmd.exe or powershell.exe.
Detects an agentic AI application (e.g., Claude Code, ChatGPT Codex) directly
spawning a package manager install command (npm install / pip install). As enterprise
adoption of agentic coding and automation tools spreads beyond developer workstations into
marketing, HR, finance, and operations, these tools autonomously pull open-source packages
from npm and PyPI on behalf of non-developer users. CrowdStrike reports poisoned packages
(e.g., 131 AI framework packages by STARDUST CHOLLIMA, 300+ dependencies in a single day by
ALTERED SPIDER) are increasingly pulled into environments this way, giving adversaries a path
to endpoints that never had traditional developer tooling scrutiny.
spawning a package manager install command (npm install / pip install). As enterprise
adoption of agentic coding and automation tools spreads beyond developer workstations into
marketing, HR, finance, and operations, these tools autonomously pull open-source packages
from npm and PyPI on behalf of non-developer users. CrowdStrike reports poisoned packages
(e.g., 131 AI framework packages by STARDUST CHOLLIMA, 300+ dependencies in a single day by
ALTERED SPIDER) are increasingly pulled into environments this way, giving adversaries a path
to endpoints that never had traditional developer tooling scrutiny.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Page 14 of 974