Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects scenarios where SearchIndexer spwaned another process with the same name, or when SearchIndexer process exists in an unexpected directory.
No description available.
This rule detects the execution of any process that originates from the '/tmp/' directory on a Linux system. The '/tmp/' directory is often used by adversaries to stage and execute malicious payloads, as it is typically writable by all users and can be used to bypass certain security controls. The rule specifically excludes executions of '/usr/bin/nextcloud' from '/tmp/' to reduce false positives.
Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost". This technique can be used for defense evasion by obscuring the true parent process.
This rule detects the creation of JavaScript files in the `AppData\Local\Temp` directory with a specific naming convention that resembles a GUID followed by a short alphanumeric e.g. or string and the '.js' eb2262cf-d737-4d55-9b98-84324ade4763ro.js.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This rule detects network connections and DNS queries to domains impersonating legitimate services, which are known to be used in the Epsilon Red ransomware campaign to deliver malicious HTA files.
Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.
Detects the creation of a randomly named executable (16-character alphanumeric) in common temporary directories (AppData\Local\Temp or C:\Windows\Temp). This behavior is associated with Warlock Dark Army ransomware.
This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.
Detects the creation of a directory with a trailing space in its name (e.g., "C:\Windows \") using the NT path prefix `\\?\`. This technique was observed in a Remcos malware campaign in June 2025 to masquerade as a legitimate system directory like `C:\Windows\SysWOW64` to evade detection.
Generic rule content from file: Masquerade - Suspicious ScreenConnect Install
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
KQL Query
KQL Query from file: Detecting Windows Downdate Abuse
Detects suspicious child processes spawned by wermgr.exe (Windows Error Reporting manager). Adversaries may abuse wermgr.exe to execute arbitrary commands or scripts, often as a method of defense evasion or privilege escalation. The rule specifically looks for common command-line utilities and scripting engines being launched as children of wermgr.exe, while filtering out known legitimate rundll32.exe activity related to WerConCpl.dll.
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.
Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Page 34 of 40