Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,439 detections
Filters
Last updated
All Time
Detection languages
8,114
7,133
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
18,057
3,027
1,500
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,459
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects PHP SAPI processes accessing /proc/self/mem (or equivalent memory mapping) and subsequently spawning a Unix shell, which is characteristic of web shell activity or exploitation of PHP memory corruption/injection vulnerabilities like zif_system.
Detects the execution of two or more distinct Active Directory discovery, credential extraction, or coercion tools (such as NetExec, Kerbrute, noPac, PetitPotam, SoftPerfect Network Scanner, or Impacket scripts) on the same device within a 1-hour window.
Detects files written under Magento pub/media/custom_options/quote by a web server or PHP process, and flags when a subsequent process command line references the uploaded file, indicating potential web shell activity.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects command-line execution of script interpreters (PowerShell, CMD, MSHTA) spawned via Windows Explorer containing download primitives and URLs, followed by immediate external network connections.
The KQL rule detects a ClickFix-style technique in which script hosts reference files disguised with an f_* naming pattern in browser profile cache directories. The key behavioural indicators are:
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
Detects Microsoft Word (winword.exe) spawning the Windows command shell (cmd.exe) to execute batch scripts (.bat or .cmd files). This behavior is commonly associated with malicious document macros attempting to drop and execute secondary payloads, excluding common system paths to reduce false positives.
Detects the sequence where a private key file is written to the host followed by the execution of ssh.exe with parameters indicating a reverse port forwarding tunnel (-R), an identity file (-i), and background execution (-N or -f) within a 30-minute window.
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects the execution of tooling routed through a reverse SOCKS5 pivot via wrappers such as via_socks.sh, proxychains4 with a SOCKS5 configuration, or LD_PRELOAD injection of libproxychains.so.
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Detects PaperCut server processes (such as pc-app.exe, pc-server.exe, or Java running PaperCut) spawning command shells or utility binaries associated with credential dumping, internal reconnaissance, or pivoting.
Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.
Detects the execution of OpenConnect VPN clients on non-sanctioned devices followed within a 4-hour window by high-volume internal network connections across multiple ports indicative of network service discovery or pivoting activity.
Detects a PaperCut server Java process spawning a local account creation or local administrators group addition, followed closely by Active Directory domain or computer enumeration from the same host within a 30-minute window.
Detects the execution of Salat Stealer C2-pushed scripts involving the disabling of recovery environment via reagentc.exe and UAC disabling via registry modification on the same device within one hour.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects WinRAR or 7-Zip extracting an archive with a hard-coded password supplied via command line from a cmd.exe batch parent, using switch patterns associated with the RareWolf AnyDesk dropper.
Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.
Page 3 of 974