Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,439 detections
Filters
Last updated
All Time
Detection languages
8,114
7,133
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
18,057
3,027
1,500
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,459
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the presence of the compromised anthropic.claude-code VS Code extension version 2.1.313 or its associated bad hash on disk, reverse SSH tunneling spawned by code editors or extension hosts, and network connections to known malicious C2 IP address 134.209.82.225.
Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.
Detects execution of Mimikatz or LSASS process memory credential theft techniques that are preceded by common discovery tools (such as nltest, net, adcmd, netexec, or kerbrute) on the same device within a 24-hour window.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Detects instances where Microsoft Teams (ms-teams.exe, Teams.exe) or its associated WebView2 process spawns a command or script interpreter (such as PowerShell, Cmd, Mshta, Wscript, Cscript) with suspicious download-and-execute arguments, which is commonly associated with ClickFix social engineering attacks or similar initial access tactics.
Detects the execution of an application named avscan.exe from suspicious writable directories such as Users Public, ProgramData, or AppData Local, followed by an outbound public network connection within a one-hour window.
Detects the Inisafe CrossWeb EX service (INISAFECrossWebEXSvc.exe) launching fsquirt.exe, which can indicate potential abuse of built-in Windows utilities following a malicious lure or script execution.
Detects reconnaissance commands (whoami, systeminfo) and PowerShell execution spawned as children of remote-access tools (such as AnyDesk, ScreenConnect, TeamViewer/QuickAssist variants, etc.), followed shortly by an outbound network connection to a .top domain from the same device.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects the correlation of a file creation event in the user Temp folder (such as t.vbs) originating from browser cache or download patterns, followed shortly by the execution of the script via wscript.exe or cscript.exe.
Detects potential staging and execution of files from the Microsoft Vault directory within AppData, often associated with adversary tooling or credential theft.
Detects correlation between an external Microsoft Teams chat creation and the subsequent launch of a remote access or monitoring (RMM) tool on the same user's device within a 30-minute window, which is indicative of potential social engineering or tech support scam initial access campaigns.
Detects cmd.exe launching curl.exe with TLS verification disabled, redirect following, an output file, and forced hostname-to-IP resolution, or the PowerShell Invoke-WebRequest with a certificate-check bypass switch, often associated with malicious trojan droppers.
Detects a sequence where an Apache HTTP server spawns a shell (sh, bash, dash) followed within a 6-hour window by network connections to internal ports (LDAP, SMB, Kerberos) from the same device, indicative of web shell activity and potential internal reconnaissance or relay attempts.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
Detects AnyDesk being silently installed with the --install and --silent flags or having an unattended-access password configured via the --set-password and _unattended_access parameters, typically piped via stdin from a batch dropper using cmd.exe.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects the execution of the rclone.exe utility with copy, sync, move, or copyto command-line arguments, correlated with outbound network connections to Wasabi S3 or MEGA cloud storage domains.
Detects behavior where PowerShell or pwsh executes msiexec.exe to silently install an MSI file located in a temporary directory with a GUID-prefixed filename, optionally following a recent download from a remote URL.
Detects Salat Stealer dropping and executing copies of Lightshot.exe in trusted directories such as Windows NT, Edge, and Chrome application paths, as well as process spawn chains involving masqueraded Lightshot executables.
Page 2 of 974