Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
20
20
IDS Classtypes
1
Detects Akira ransomware deployment by monitoring the execution of suspected binary files (n.exe or locker.exe) from the C:\ProgramData directory, correlated with system recovery inhibition commands (e.g., vssadmin, wmic, bcdedit) executed on the same host within a 2-hour timeframe.
Detects the creation of persistence mechanisms, specifically cron jobs or LaunchAgent plist files, initiated by the OpenClaw agent process tree (openclaw, openclaw-runtime, openclaw-agent). This behavior is associated with ClawHub skills attempting to maintain C2 access after the skill itself has been removed.
This rule detects suspicious command-line activity where shell interpreters (bash, sh, dash, python) are used to search for or interact with potentially sensitive system files, such as password files or custom indicators of compromise like 'evil_tenant'. The query targets grep, find, ls, and echo commands used to locate or confirm the existence of these sensitive artifacts.
Detects the execution of common Linux administrative, network, and system information gathering commands, often associated with reconnaissance activity by an adversary after gaining shell access.
Detects the execution of known analysis or command-line tools by AnyDesk, a legitimate remote access tool. This pattern is often observed during post-exploitation activities where an attacker uses authorized remote access tools to execute further commands or deploy diagnostic tools on the compromised host.
Detects unauthorized attempts to access or interact with the Veeam Backup database, including psql.exe direct queries, PowerShell scripts attempting to decrypt credentials using DPAPI, and encoded PowerShell commands launched from cmd.exe that target the Veeam environment.
Detects the unauthorized installation and execution of cloudflared (a Cloudflare Tunnel binary). This rule monitors for PowerShell-based downloading of the binary, silent installation via msiexec, service installation commands, and cloudflared execution from unexpected parent processes, which are patterns often associated with adversary lateral movement or establishing persistence.
This rule detects the execution of PowerShell commands related to network share discovery (Invoke-ShareFinder, Get-NetShare) and the execution of the SoftPerfect Network Scanner (netscan.exe/netscan64.exe), which are techniques commonly used by adversaries for internal network reconnaissance.
Detects indicators of exploitation attempts for the libssh2 pre-auth heap RCE vulnerability (CVE-2026-55200). The rule monitors for the execution of known harness binaries, abnormal child processes spawned by sshd, unauthorized file creation in sensitive temporary directories, and the loading of libssh2 libraries from non-standard, writable locations.
Detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, brave.exe, opera.exe) initiate command-line utilities (cmd.exe, powershell.exe, wscript.exe) that include arguments indicative of downloading remote resources (curl, iwr, Invoke-WebRequest, bitsadmin, certutil). This pattern is frequently used to download and execute second-stage malicious payloads.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects unauthorized execution of node.exe by the Flowise process, where a case-insensitive environment variable (node_options) is used to bypass Flowise's security block list. This enables attackers to leverage the --require flag to preload malicious JavaScript code. The detection also monitors for the presence of a 'flowise_marker.txt' file as a secondary indicator.
Detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, brave.exe, opera.exe) initiate command-line utilities (cmd.exe, powershell.exe, wscript.exe) that include arguments indicative of downloading remote resources (curl, iwr, Invoke-WebRequest, bitsadmin, certutil). This pattern is frequently used to download and execute second-stage malicious payloads.
Detects indicators of potential exploitation of CVE-2026-46331 in RustDesk, which involves a session permission bypass. The rule identifies suspicious post-exploitation behavior, specifically when rustdesk.exe spawns common command-line or reconnaissance utilities, and when it initiates outbound network connections on non-standard relay ports.
This rule detects potential exploitation of the PHP StreamBucket SOAP RCE vulnerability (CVE-2026-55199). It monitors for characteristic post-exploitation behaviors, including the spawning of unexpected shell or system utility processes, access to sensitive memory mapping files (/proc/self/maps or /proc/self/mem) for ASLR defeat, creation of specific RCE marker files (e.g., /tmp/php857_rce_*.txt), and anomalous outbound network connections following SOAP request activity.
Detects the execution of ClickOnce applications (via dfsvc.exe, rundll32.exe with dfshim.dll, or by opening .application/.appref-ms files) that are being launched from a remote web or file share source. This behavior is a common technique for proxying malicious code execution.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects the use of dsquery.exe to enumerate users in Active Directory. This command-line utility is often used by attackers for reconnaissance to gather information about domain users.
Detects suspicious PowerShell execution initiated by explorer.exe, specifically when the command line includes a .lnk file, execution policy bypass, and contains keywords or paths commonly associated with malicious activity (e.g., tor, ssh, github.io, dropbox.com, or suspicious temporary/public directories). This pattern is often observed in initial access or execution phases of attacks.
This rule detects potential discovery activities indicative of a virtual machine or virtualization environment enumeration. It monitors for the execution of wmic.exe or powershell.exe triggered by suspicious parent processes (python.exe, chost.exe) that query hardware-specific identifiers like Manufacturer, Model, or MAC Address using Win32_ComputerSystem or Win32_NetworkAdapterConfiguration.
Detects Server-Side Template Injection (SSTI) and subsequent Remote Code Execution (RCE) attempts within the Floci API Gateway environment. The rule monitors for suspicious child processes spawned by the Floci JVM (e.g., shell execution), the creation of specific RCE proof-of-concept marker files, and the execution of associated exploitation tooling or IAM-bypass command arguments.
Page 469 of 974