Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the creation of user namespaces on Linux systems by unprivileged users. The 'unshare' command with '--user' or '-U' flags allows a process to move into a new user namespace, which can be abused for privilege escalation or container escape. The rule specifically excludes common container runtimes and processes running as 'root' to reduce false positives.
Detects use of Linux extended attributes to hide malicious data
Detects AnyDesk remote desktop used as persistent unauthorized C2 channel
This rule detects a sequence of events indicative of ransomware deployment following a successful Remote Desktop Protocol (RDP) connection. Specifically, it looks for an inbound RDP connection (RemotePort 3389) to a device, followed within 60 minutes by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') on the same device. This pattern suggests an attacker gaining initial access or moving laterally via RDP and then deploying ransomware.
This rule detects Python spawning native OS command utilities such as 'systeminfo.exe', 'whoami.exe', and 'ipconfig.exe'. The detection logic specifically looks for at least two distinct reconnaissance commands executed by the same Python process within a one-minute window, indicating potential victim profiling for a C2 panel, as observed in OpenClaw campaigns.
Detects when a known OpenClaw AI agent process spawns a shell to download and immediately execute a script. This is a common pattern used by malicious "Skills" to establish persistence or run further payloads, as detailed in the NSFOCUS report.
Monitors for the use of 'sshpass' to automate SSH logins, specifically targeting accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) and bypassing strict host key checking. This technique has been observed in ShinyHunters attacks for lateral movement.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key LoLBin technique used in the CrashFix campaign.
This rule detects the execution of suspicious processes ('servertool.exe' or 'encrypt.exe') within 60 minutes of an inbound RDP connection being accepted on a device. This could indicate an adversary establishing remote access and then deploying tools for further compromise, such as data exfiltration or encryption for ransomware.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects the execution of PowerShell or Windows script hosts containing a combination of WMI system enumeration queries (specifically targeting Win32_ComputerSystem) and common virtual machine/sandbox environment artifacts (vmware, vbox, sandbox). This behavior is consistent with the Gamaredon group's PteroSand malware performing environment fingerprinting to identify analysis environments and abort execution.
Detects the execution of 'opsec_enum.sh', a post-exploitation cleanup script, and associated activity involving ZipSlip-based webshell persistence components (such as 'mkzip34.py' and specific chunked file names) used by the threat actor MexicanMafia during Operation Escaneo.
Detects LCRYX ransomware performing UAC bypass by utilizing VBScript to spawn a new wscript.exe process with elevated privileges. The rule monitors for WScript or CScript processes spawning another WScript process where the command line contains the '/elevated' flag, indicating the use of the Shell.Application object's ShellExecute method with the 'runas' verb.
This rule detects the execution of scripts and commands associated with known SAP RFC exploitation attempts, including specific shell scripts used for RCE or credential extraction, as well as the invocation of SAP function modules like SXPG_CALL_SYSTEM for OS command execution. These patterns are consistent with post-exploitation activity or unauthorized system administration in SAP environments.
Detects attempts to bypass User Account Control (UAC) by spawning processes from fodhelper.exe, eventvwr.exe, or computerdefaults.exe. These executables are known to be vulnerable to UAC bypass techniques, allowing an attacker to elevate privileges without user interaction.
This rule detects the execution of known SMB exploitation tools (e.g., Python-based SMBGhost scanners/payloads, Metasploit resource scripts for EternalBlue) and identifies high-fan-out SMB scanning activity or unauthorized SMB connections from non-standard processes to an internal subnet (10.39.x.x).
This rule detects activities associated with CORS-based exploitation and session token harvesting, specifically targeting the creation or access of known exploit files (e.g., cors_exploit_poc.html) and the use of command-line tools (curl, wget, PowerShell) to interact with suspicious artifacts or session tokens (AMAUTHID/SAT).
Detects the execution of known Oracle database PII exfiltration scripts and patterns associated with the 'MexicanMafia Operation Escaneo' campaign. The rule monitors for specific command-line activity, including the use of extraction scripts like 'dump_oracle_pii.sh', 'fast_extract.py', and database-level exfiltration techniques such as UTL_FILE or sys_eval targeting incremental CSV exports to /tmp.
This rule detects activities associated with the DRAYN malware, specifically the unauthorized modification of Discretionary Access Control Lists (DACLs) on MSP management platform directory archives using icacls, followed by the creation of a scheduled task to establish persistence.
Detects the execution of cmd.exe triggered by specific potentially malicious filenames or involving known ransomware-related artifacts, such as 'boottel.dat', ransomware note files, or specific suspicious file extensions like '.SZO'. This is indicative of ransomware deployment or post-compromise cleanup and extortion activities.
Detects attempts to exploit the PwnKit vulnerability (CVE-2021-4034) in Polkit's pkexec. The rule monitors for malicious command-line arguments involving GCONV_PATH environment manipulation, the execution of pkexec by non-root users, and the presence of associated PwnKit payload artifacts, such as base64-encoded strings or specific chunked files.
Page 464 of 974