Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
20
20
IDS Classtypes
1
Detects reconnaissance behavior associated with the KuinaExtractor tool, identified by three or more distinct WMI hardware-related queries (CPU, disk, memory, etc.) executed within a 5-minute window by a non-administrative parent process.
Detects execution of PowerShell or PWSH containing multiple suspicious command line flags commonly associated with malicious scripts and evasion techniques, such as bypassing execution policies, running in hidden windows, using encoded commands, or utilizing invoke-expression.
Detects potential tampering with Windows Defender settings such as adding exclusion using wmic
Detects Node.js processes ('node' or 'node.exe') spawning other processes or executing commands that reference suspicious file paths, such as '.libcache.so' or '.sh.local', or utilizing risky syscall patterns like 'memfd_create' or 'fexecve'. This pattern is often associated with malicious npm post-install scripts or supply chain attacks.
This rule detects when the node.exe process initiates an outbound network connection to a specific set of non-standard, often high-numbered ports (8443, 8445, 8453, 5555, 56001-56003) over the public internet. This behavior is often indicative of potential command and control (C2) communication, reverse shells, or malicious scripts executing within a Node.js runtime environment.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects activity associated with a known malicious campaign involving 'Photo ZIP' themed lures. It identifies DNS queries to actor-controlled domains, the spawning of PowerShell by Explorer.exe with command lines referencing photo-related filenames or external file-sharing services, and the subsequent downloading of the node.exe runtime to user-accessible directories (consistent with TonRAT delivery).
Detects the use of the legacy OSQL.exe utility to connect to a local SQL server instance and execute a query that writes output to a file. This behavior is indicative of manual data discovery or exfiltration from a local database.
Detects the creation or modification of Windows Registry Run keys that point to potential Node.js applications or scripts. This is a common persistence technique where attackers configure malicious scripts to execute upon user logon or system startup.
Detects the creation of suspicious IDE configuration files (e.g., .vscode/tasks.json or .claude/index.js) associated with the poisoned verana-blockchain Go module, as well as the subsequent execution of these files by the Node.js runtime. This detection aims to identify supply chain compromise attempts targeting developers.
This rule detects potentially malicious process behavior on Linux systems. It triggers on two conditions: 1) Masquerading of the 'systemd-userdbd' process by detecting processes named 'systemd-userdbd' that do not originate from the legitimate system path. 2) Fileless execution by detecting process image paths that contain 'memfd:', which is commonly associated with loading malicious binaries directly from anonymous memory to evade disk-based detection.
Detects the execution of the fscan network scanner binary, its use with common scanning arguments, or any network communication with the known staging IP address associated with the fscan deployment.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Detects multiple techniques associated with Linux post-exploitation and persistence, including LD_PRELOAD environment variable hijacking, suspicious cron jobs, profile.d persistence modifications, systemd service masquerading via prctl, and fileless execution via memfd_create.
This rule detects instances where the IIS web server process (w3wp.exe) spawns common command-line interpreters such as cmd.exe or powershell.exe. This activity is a classic indicator of a successful web application exploit, potentially leading to remote code execution.
This rule detects suspicious activity associated with the TinyRCT malware, specifically identifying the loading of 'MyAppDomainManager.dll' in unexpected process paths or in conjunction with 'chrome_setup.exe'. It also monitors for 'PerfWatson2.exe' instances executing outside of the expected local application data directory, which is a known indicator of this campaign's persistence and execution behavior.
Detects potential UAC bypass or privilege escalation attempts involving the 'runas' command. The rule identifies suspicious process patterns such as non-standard parent processes invoking runas, self-relaunching applications with elevated command-line flags, and specific executable naming conventions associated with known threat actor activities.
Detects the execution of a process named 'packet_edit_meme' on Linux systems, which is often indicative of specific malware or unauthorized tool usage.
Detects the execution of the 'aa-exec' process with specific command-line arguments ('trinity', 'chrome', or 'flatpak') that are often associated with malicious tools, persistence, or bypass techniques.
Page 473 of 974