Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects procdump execution targeting lsass.exe
A variation of https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
A variation of https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
Detects host-based reconnaissance activity patterns indicative of Trickbot malware. The rule monitors for a high frequency (>= 4 unique commands within a 30-minute window) of diagnostic commands ('tasklist', 'systeminfo', 'ipconfig', 'net') executed by cmd.exe or powershell.exe, which is a common behavior pattern for adversary discovery processes.
Detects instances where explorer.exe launches a PowerShell process originating from an LNK file, which then performs a remote download of a Node.js runtime and JavaScript implant (TonRAT) to standard Windows temporary or application data directories. This activity is indicative of the TonRAT campaign targeting hospitality front-desk systems.
Detects User Account Control (UAC) bypass attempts where known auto-elevating Windows binaries like fodhelper.exe, eventvwr.exe, or sdclt.exe are used as proxy processes to launch child processes with high integrity without user prompts.
Detects execution of the tc (traffic control) utility with pedit actions by non-root users. This pattern is indicative of exploitation attempts targeting the Linux kernel act_pedit subsystem (CVE-2026-46331), which can lead to page cache corruption and local privilege escalation.
Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.
Detects the execution of a specific malicious executable (COU_ITR-1_to_4_AY2026-27.exe) identified as part of the Operation DragonReturn spearphishing campaign. The campaign impersonates the Indian Income Tax Department to lure users into executing the file.
Detects the execution of DcRAT malware by monitoring for the creation of the specific global mutex 'Global\ShitSetupOn26126k' commonly used by this strain to enforce single-instance execution on a host.
Detects the malicious execution of the Bun JavaScript runtime associated with the Miasma supply chain attack. The rule identifies suspicious child processes spawned from development directories (like node_modules) that execute Bun to read sensitive configuration files, SSH keys, and cloud credentials typically targeted for exfiltration.
Detects the use of osql.exe or sqlcmd.exe to query database schema information (such as sys.objects, sys.tables, or INFORMATION_SCHEMA) with output redirected to a file. This behavior is flagged when launched from non-standard parent processes, specifically those commonly associated with web shell activity like w3wp.exe, suggesting post-exploitation database discovery.
Detects reconnaissance and credential harvesting activities associated with the Lambsys cryptominer campaign. The rule monitors for unauthorized enumeration of SSH directories, key files, and the use of SSH utilities for lateral movement, specifically triggered by the presence of 'isp.sh' or 'lambsys' in command arguments or related patterns.
Detects sandbox evasion techniques employed by the Gamaredon group using their PteroSand methodology. The rule monitors for WMI queries executed by suspicious parent processes to identify virtualization artifacts (VMware, VirtualBox) or system hardware/system information, which are characteristic of environment reconnaissance and timing-based checks prior to payload activation.
Detects persistence mechanisms used by Gamaredon's Ptero-family implants (e.g., PteroSetup, PteroPSDoor) which modify Windows registry run keys to execute malicious scripts or binaries located in suspicious directories like APPDATA or TEMP. The detection specifically looks for the combination of registry run key modifications and the use of obfuscated or stealthy execution arguments associated with PowerShell, VBScript, or MSHTA.
Detects instances where the WinRAR utility process creates, writes, or drops a file into the Windows Startup folder. This behavior is a common technique used by adversaries to achieve persistence, as any executable placed in this folder will automatically run upon user login.
Detects the use of 'unshare' or 'ip' commands by non-root users to manipulate Linux namespaces (e.g., user, network, or xfrm namespaces). These commands can be used to bypass security restrictions, facilitate container escapes, or perform local privilege escalation by exploiting vulnerabilities in the Linux kernel namespace subsystem.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Detects execution artifacts and prerequisite activities associated with the DirtyClone (CVE-2026-43503) local privilege escalation exploit. This includes monitoring for the creation of unprivileged user namespaces, loading specific kernel modules (esp4, esp6, rxrpc) often used in such exploits, compilation of associated exploit source files, and direct interaction with /proc/self/mem to perform memory-based exploitation.
This rule detects the creation of directories or files within /var/tmp that use the hidden naming convention (dot-prefix), specifically looking for '.xlamb' or '.x'. Such hidden directories in temporary storage locations are commonly used by attackers for staging malicious tools, malware, or backdoors.
Detects attempts to disable or modify critical Linux security subsystems including SELinux and AppArmor. The rule monitors for the execution of commands such as setenforce, aa-teardown, and systemctl, or direct modifications to security configuration files.
Detects the GIFTEDCROOK malware performing post-execution cleanup using cmd.exe. The malware utilizes a command-line chain consisting of 'timeout' and 'del' to remove staged payloads from C:\ProgramData and persistence shortcuts (.lnk files) from the user's Startup folder after a delay.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Page 474 of 974