Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,439 detections
Filters
Last updated
All Time
Detection languages
8,114
7,133
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
18,057
3,027
1,500
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,459
7,567
3,444
2,845
2,689
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects web server processes (such as Apache, httpd, or PHP) spawning a Unix shell (sh, bash, dash) and executing discovery commands (such as id, hostname, uname) with output redirection to proof files or embedded in callback URLs via command substitution.
Detects a PowerShell download-and-execute command referencing specific typosquatted lure domains (e.g., choclatey.org, massgravel.net) combined with follow-up script activity writing into a fake SystemHealth\Update directory.
Detects Chromium-based browsers launched with remote debugging port 9222 or execution of chrome-decryptor tooling by Python processes, indicative of credential theft or Chrome CDP cookie extraction (such as Armorsteal).
Detects suspicious process execution where a shell or scripting tool is spawned by the nsppe process or running under the nobody account, followed closely by file creation or modification activity in persistence locations or NetScaler GUI web directories.
Detects operator synchronization scripts (sync-all.sh, sync-memory.sh, sync-cc-users.sh) spawning SSH, rsync, or scp commands targeting AI-named jump-server accounts (claude, grok, gemini, glm).
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects modifications to the Tor configuration file (torrc) that permit SSH traffic (port 22) in the exit policy, followed by a Tor service reload or restart on the same device within a 4-hour window. This behavior may indicate an adversary setting up an onion routing proxy or covert tunnel.
Detects a Python process spawning msiexec.exe followed by a high volume of LDAP connections (burst) from the same device within a 30-minute window, potentially indicating post-exploitation activity such as domain enumeration.
Detects PowerShell being launched directly from the Windows Run dialog
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects cmd.exe executing a ping-based delay to loopback followed by self-deletion of the batch script (%~f0), as well as bulk deletion of common archive and executable files, typically associated with malware droppers like RareWolf.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects instances where inst.exe running from C:\ProgramData\Intel with specific command-line arguments (extensionless and key-like) subsequently writes files to the EFI system partition or boot paths on the same device.
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Detects command output staged in a temporary file (/tmp/nx_cmd.txt) by a Unix shell spawned from ExifTool or Perl, typically resulting from Gotenberg CVE-2026-42589 exploitation, or detects the specific staging filename behavior independently.
Detects NTDSUtil commands associated with Active Directory database export, installation media preparation, and snapshot creation, which may facilitate offline credential extraction.
Correlates internet-origin executable creation with subsequent execution by Windows shell processes using matching device, file path and SHA1 hash within a five-minute timeframe.
Detects a sequence where a SharePoint application pool worker process (w3wp.exe) spawns a command shell (cmd.exe, powershell.exe, pwsh.exe) related to SharePoint, followed shortly (within 1 hour) by high-fidelity lateral movement tooling or remote execution techniques (such as PsExec, WMI, PowerShell remoting, or scheduled tasks) on the same host.
Detects a sequence where PowerShell or PWSH executes a web download referencing an .mp4 file using download cmdlets, followed within 1 hour by the execution of NetSupport Manager components (client32.exe or pcictlui.exe) from a user-writable path.
Page 7 of 974