Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the spawning of DllHost.exe (a Windows COM surrogate process) by identified STOCKSTAY malware components or via suspicious msiexec installations targeting STOCKSTAY directories. This behavior is indicative of inter-process communication (IPC) used by Turla's STOCKSTAY malware suite.
Detects modifications to Windows Registry 'Run' or 'RunOnce' keys involving specific values ('MicrosoftUpdate', 'OneDrive') that do not originate from standard Microsoft or OneDrive installation directories. The rule correlates registry changes with process execution events to identify potentially malicious persistence mechanisms.
Detects the creation of scheduled tasks using names associated with Microsoft Edge or Google update processes to achieve persistence. The rule specifically targets the deployment of known payloads like TinyRCT (vmwared.exe) or PerfWatson.exe at logon with highest privileges, masquerading as legitimate update tasks.
Detects the execution of the VNT tunneling tool disguised as a legitimate VMware executable (vmwared.exe) located in C:\ProgramData\VMware\. The rule also identifies the creation of a scheduled task named 'MicrosoftEdgeUpdate' configured to execute the masqueraded binary at user logon with elevated privileges.
Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.
Detects the execution of regsvr32.exe with command-line arguments indicative of 'Squiblydoo' style attacks, which use the signed Windows binary to proxy the execution of remote scripts or local COM scriptlets (.sct files). The rule specifically flags the use of /i with HTTP(S) URLs, loading scrobj.dll, or specific combinations of /s /u /i flags to bypass application control mechanisms.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects the creation of a new local account using the 'net' utility, followed immediately by that account being added to the local administrators group on the same endpoint. This behavior is a common indicator of persistence or privilege escalation attempts.
Detects potential container breakout attempts on Windows systems by monitoring for the launch of privileged containers with sensitive host paths mounted, the execution of host-level processes directly spawned by container runtime binaries (docker.exe, containerd.exe), and direct access to sensitive host filesystems (e.g., C:\windows, C:\etc, C:\programdata) by container runtimes.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects the execution of cmd.exe triggered by specific potentially malicious filenames or involving known ransomware-related artifacts, such as 'boottel.dat', ransomware note files, or specific suspicious file extensions like '.SZO'. This is indicative of ransomware deployment or post-compromise cleanup and extortion activities.
This rule detects potential malvertising or drive-by download activity by identifying when common web browsers spawn script-interpreting processes (such as powershell.exe, cmd.exe, or mshta.exe) that execute suspicious commands indicative of obfuscation or payload delivery (e.g., IEX, EncodedCommand). It further correlates this activity with outbound network connections initiated by the child process within a 30-second window, which is characteristic of the second stage of a malware delivery chain.
Detects a suspicious sequence of events attributed to APT37, where a HWP or HWPX decoy file is written to user-accessible staging directories (Downloads, Temp, Desktop, Public) followed by the execution of a .lnk file using cmd.exe or explorer.exe within 30 seconds on the same device.
Detects potential clipboard harvesting behavior indicative of information stealers like StealC. The rule monitors for processes executing from suspicious, user-writable directories (e.g., AppData, Temp) that perform clipboard access operations while lacking typical interactive process characteristics.
Detects ClickFix social engineering attacks where a web browser process spawns a scripting interpreter (powershell.exe, mshta.exe, or wscript.exe) or where a command shell executes PowerShell with encoded arguments, typically indicating a user has been tricked into executing malicious code.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects MYRA RAT delivery via malicious npm package lifecycle scripts (e.g., postinstall) that trigger the compilation of native binaries such as libcache.so, memfd_loader, and others on Linux hosts.
Detects potential exploitation of CVE-2026-8461 (PixelSmash) where an attacker hijacks the AVBuffer.free function pointer in media processing software (ffmpeg, ffprobe, etc.) to trigger arbitrary code execution via a spawned shell process.
Detects behavior indicative of the AMOS (Atomic macOS) infostealer, where a malicious process uses 'osascript' to display a fake System Preferences password prompt to the user and then attempts to validate the harvested credentials using 'dscl -authonly'.
Page 467 of 974