Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,439 detections
Filters
Last updated
All Time
Detection languages
8,114
7,133
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
18,057
3,027
1,500
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,459
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects file creation events related to known GLASSWORM VS Code extension files or WebAssembly (WASM) loader JavaScript shims. It also identifies process execution where the VS Code extension host spawns 'node.exe' with known GLASSWORM JavaScript shims. This rule aims to identify the presence and execution of the GLASSWORM malware.
Detects the mounting of an ISO file, particularly those with diplomatic lure filenames, followed by the execution of an executable from a newly mounted optical or removable drive. This sequence of events is indicative of an attacker using a malicious ISO to deliver and execute malware.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
Detects the SHEETCREEP malware's melt function, which uses a hidden 'cmd.exe' process to forcibly delete executables. This is characterized by 'cmd.exe' spawning with a specific command line pattern involving 'choice /C Y /N /D Y /T 2' for a delay, followed by 'del /f /q' to delete an .exe file. The rule also looks for file deletion events of .exe files initiated by 'cmd.exe' outside of the C:\Windows\ directory with 'del /f' or 'del /f /q' in the command line.
This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.
Detects instances where OpenVPN Connect executables (OpenVPNConnect.exe, openvpn.exe) spawn shell interpreters or script hosts. This pattern is often indicative of exploitation or post-exploitation activities, as legitimate VPN client operation does not typically require the execution of cmd.exe, PowerShell, or script engines.
Detects instances where the Ghidra reverse engineering tool (via java.exe or javaw.exe) spawns suspicious child processes. This behavior is considered anomalous as Ghidra typically does not require launching command shells, scripting interpreters, or other system binaries directly from its process tree. Such activity often indicates that an attacker is using the Ghidra environment to execute secondary payloads or perform post-exploitation tasks.
Detects the execution of suspicious binaries spawned by the Windows script hosts (wscript.exe, cscript.exe) from the AppData directory. This pattern is indicative of the Grandoreiro banking trojan, which masquerades as an Adobe Reader update prompt and drops its payload into temporary folders to execute.
Detects potential exploitation attempts against Flowise by monitoring for suspicious child process creation. The rule flags Node.js processes spawned by Flowise that utilize case-insensitive command-line bypass patterns or reference suspicious environment variables, which may indicate an attempt to override security configurations through environment variable manipulation (e.g., node_options).
Detects the use of 7za to extract archives into the Avast Software directory, a behavior observed in Pay2Key ransomware campaigns to perform DLL hijacking for execution, persistence, or privilege escalation.
Detects the execution or creation of files named GT_NET.exe or Gt_net.exe, which are associated with the Grixba ransomware (Play Ransomware group). The rule also identifies files that masquerade as SentinelOne by utilizing SentinelOne-related product, company, or description metadata but are located outside of the legitimate SentinelOne installation directory.
This rule detects process execution where the command line contains specific strings commonly associated with process debugging, environment analysis, or exception handling (e.g., 'RtlGetCurrentPeb', 'timeBeginPeriod', 'gcstoptheworld', 'trace/breakpoint trap'). These artifacts are frequently observed in security research tools, malware analysis frameworks, or during the development of exploit payloads designed to interact with process memory or handle execution flow interruptions.
Detects execution of the 'fsutil' command with 'setZeroData' parameters in conjunction with a ping to 127.0.0.2. This pattern is commonly associated with malicious activities involving data manipulation or potential preparation for disk-level operations, as 'fsutil setZeroData' can be used to set a range of a file to zeros.
This rule detects potentially malicious attempts to escape a container or manipulate the host filesystem using the 'docker cp' command. It identifies commands that contain directory traversal patterns (e.g., '../', '..\') or direct references to the host filesystem via '/proc/self/root'.
Detects instances where the RustDesk remote access tool spawns suspicious child processes, such as command shells, scripting interpreters, or system administrative utilities. This pattern is often indicative of an adversary abusing legitimate remote access software to execute arbitrary commands, perform discovery, or maintain interactive control over a host.
Detects OS command execution spawned by a Java process, potentially indicating successful exploitation of Velocity template injection (e.g., in Flowise or Floci) where java.lang.ProcessBuilder is leveraged to execute malicious commands.
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
Detects instances where ImageMagick (convert, mogrify, magick, identify) attempts to execute Ghostscript or shell interpreters. The rule flags suspicious behavior such as spawning shell interpreters, using shell metacharacters or pipes in the command line, or executing Ghostscript from non-standard or potentially writable directory paths, which are indicative of a delegate hijack exploitation attempt for arbitrary command execution.
Detects potential unauthorized remote control activity via RustDesk, specifically identifying sessions that spawn child processes (e.g., cmd.exe, powershell.exe) or exhibit behavior indicative of bypassing permission constraints on RustDesk processes not signed by the official publisher.
Detects attempts to perform a container escape using the 'docker cp' command, where a maliciously crafted source path with traversal sequences allows the container daemon to write files outside of the container boundary. The rule monitors for suspicious 'docker cp' command executions and the creation of artifacts associated with known path traversal escape techniques in the host filesystem by the Docker daemon.
This rule monitors for the presence of known exploit harness binaries associated with CVE-2026-55200 on disk or in command lines, and identifies post-exploitation activity where common network utilities (curl, git, php) execute unsigned or suspicious child processes, which often indicates lateral movement or payload staging.
Page 471 of 974