Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This query hunts for potential execution linked to the Axios npm supply chain compromise by detecting node.exe process activity tied to suspicious npm lifecycle markers (postinstall, setup.js, plain-crypto-js). It helps identify systems that may have executed malicious install-time scripts.
Detects the PowerShell 'Stop-VM -TurnOff' pattern used by Kyber ransomware's "experimental" Hyper-V functionality to force hard-stop all running VMs prior to encryption, releasing file locks on VHD/VHDX disks. This rule also includes an extended field 'IsEnumeration' to identify instances where 'Get-VM' and 'ConvertTo-Json' are used, which could indicate VM enumeration prior to termination.
This rule detects the execution of the 'make' command with a '-f' flag pointing to a makefile located in common temporary or writable directories. This behavior can be indicative of an adversary attempting to execute arbitrary commands or escalate privileges by leveraging the 'make' utility to process a malicious makefile from a non-standard location.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns suspicious child processes. The suspicious child processes include certutil.exe, mshta.exe, rundll32.exe, curl.exe, wget.exe, wscript.exe, cscript.exe, bitsadmin.exe, regsvr32.exe, msiexec.exe, and cmd.exe. The rule also includes a join to ensure the parent PowerShell process was launched by explorer.exe, which can help filter out some automated or administrative PowerShell activities.
This rule detects suspicious command execution patterns involving the Lua interpreter on Linux systems. It specifically looks for Lua interpreter processes executing commands that run suspicious functions. These functions can be abused by adversaries to execute arbitrary commands, establish network connections, or load dynamic libraries, indicating potential malicious activity.
Detects Python executables spawning shell interpreters such as cmd.exe or powershell.exe. This activity is indicative of the SNOWBASIN local HTTP bindshell proxying and executing remote commands on the host system on behalf of the attacker, as observed in UNC6692 campaigns.
This rule detects the execution of specific suspicious scripts, 'dra.ps1' or 'handala.bat', via common Windows command shells such as PowerShell (powershell.exe, pwsh.exe) or Command Prompt (cmd.exe). This activity could indicate malicious execution of known adversary scripts.
Detects the execution of PowerShell using the ExecutionPolicy Bypass flag combined with the Net.WebClient DownloadFile method. This pattern is frequently used by threat actors and ransomware affiliates, such as The Gentlemen RaaS, to stage payloads from internal or external servers.
Detects php/perl/ruby one-liner execution patterns combined with network or shell invocation primitives, consistent with trusted interpreter abuse and execution guardrail bypass.
This rule detects the execution of the 'awk' command on Linux/Unix systems when it is used with specific command-line arguments that indicate indirect shell execution.
For example, using environmental variables where an attacker modifies the environment variable to point to a malicious binary.
For example, using environmental variables where an attacker modifies the environment variable to point to a malicious binary.
This rule detects the execution of hidden shell scripts (files starting with a dot) within the /tmp/ or /var/tmp/ directories on Linux systems, specifically when initiated using `nohup`. This behavior is often associated with malware or post-exploitation activities to maintain persistence or execute malicious payloads discreetly. The rule looks for process execution events where the command line includes `nohup` and references a hidden `.sh` file in a temporary directory.
Detects the execution of PowerShell scripts located in the 'WMILoad' directory, specifically targeting 'ClockRemoval.ps1'. This script is the core AV killer component of the Dragon Boss multi-stage attack chain used to neutralize security controls.
Detects the classic Matt Graeber AMSI bypass technique using reflection to set amsiInitFailed to True. This one-liner disables AMSI scanning for the entire PowerShell session.
Detects execution of Impacket's MSSQL client tool, commonly used for lateral movement against Microsoft SQL servers using compromised credentials. Includes detection of proxychains usage and Python-based execution patterns.
Detects the full infection chain of a trojanized Proxifier installer hosted on GitHub (lukecodix/Proxifier releases) distributing ClipBanker RAT. Active since early 2025 with 2,000+ confirmed victims (India/Vietnam focus). The malicious wrapper adds Defender exclusions for TMP/powershell/conhost, creates a ~1.5KB stub (Proxifier*.tmp) as a donor process, injects api_updater.exe and proxifierupdater.exe, then hollows into conhost.exe and fontdrvhost.exe to deliver a fileless C++ ClipBanker payload that replaces crypto wallet addresses across 26+ blockchains (BTC, ETH, SOL, XRP, DOGE, LTC, XMR, ADA, BNB, etc.). Multi-stage payload retrieved from pastebin, snippet.host, chiaselinks.com, rlim.com, paste.kealper.com, and secondary GitHub/Gitea repos. Persistence via HKLM\SOFTWARE\System::Config (Base64 PowerShell) + scheduled task. 12 queries covering known hashes, trojanized binary names, Defender exclusion abuse, registry persistence, schtask-to-PowerShell-to-registry chain, process hollowing into OS binaries, C2/payload domains, Pastebin/Gist exact-path IOC hits, fontdrvhost/conhost outbound anomaly, Proxifier*.tmp stub detection, GitHub-release-to-execution correlation, and full kill-chain correlation.
Detects the use of PowerShell's BitsTransfer module to download a payload named "syncobs.exe". This specific file and behavior are associated with the REF6598 campaign, where it is used as a secondary staging mechanism to deliver the PhantomPull in-memory loader and ultimately the PhantomPulse RAT.
Detects instances where the legitimate Obsidian application spawns shell or scripting interpreters (PowerShell, cmd, sh, bash, zsh). This behavior is associated with the REF6598 campaign, where attackers abuse the Obsidian "Shell Commands" community plugin to execute malicious code and deliver the PhantomPulse RAT.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
Detects the secondary staging mechanism used by the intermediate PowerShell script before the PhantomPull in-memory loader is executed. This rule specifically looks for PowerShell or PowerShell Core processes executing commands that utilize `Start-BitsTransfer` to download a file named `syncobs.exe`.
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection. The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, like unusual command-line arguments, or known malicious behaviors associated with this tool. Specifically, it looks for `cpuz.exe` spawning `powershell.exe` with suspicious command-line arguments like `[Console]::In.ReadToEnd()` or `Invoke-Expression`, or `csc.exe` spawning `chrome.exe`.
This detection identifies the presence of ChipSoft HiX electronic health record (EHR) software within the environment. ChipSoft is the dominant EHR provider in the Netherlands (~70% market share in Dutch healthcare). On April 7, 2026, ChipSoft was hit by a ransomware attack affecting HiX on-premise, HiX SaaS, and the SaaS patient portal. Z-CERT (Dutch healthcare CERT) advised all customers to immediately disconnect VPN connections to ChipSoft and intensively monitor network traffic.
This KQL detection covers 3 areas:
1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM
2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days
3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains
No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
This KQL detection covers 3 areas:
1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM
2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days
3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains
No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
Page 145 of 191