Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
This rule monitors Android device process events for the execution of 'adb' commands aimed at modifying sensitive system configurations. It specifically tracks attempts to enable accessibility services, toggle wireless debugging, or establish unauthorized ADB pairings. The rule identifies potential malicious intent by aggregating multiple suspicious configuration changes on the same device within a short time window.
This rule detects the installation of common AI agent and orchestration frameworks (e.g., LangChain, AutoGen, CrewAI) using command-line package managers (pip, npm, conda) that point to non-standard or unverified package indexes. This behavior is a common indicator of a potential software supply-chain compromise, where an adversary attempts to inject malicious code by forcing the installation of packages from an attacker-controlled source.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
Detects the execution of potentially malicious processes originating from common mail client attachment cache directories, the use of suspicious double extensions in file names, or common command-line interpreters being spawned by Microsoft Office applications, which are high-confidence indicators of phishing or malicious document exploitation.
Detects the execution of command shells or common post-exploitation utilities as child processes of network appliance management services (e.g., VPN gateways, firewalls, web servers). This pattern indicates potential exploitation of public-facing infrastructure where an attacker achieves code execution through the management daemon or its web components.
Detects the execution of the GigaWiper malware or the use of common system commands associated with destructive data activities, such as recursive file removal, disk formatting, or secure data overwriting, often used by threat actors for extortion.
Detects incoming HTTP requests to a FortiSandbox device that contain suspicious command injection patterns. The rule monitors both the URI and the request body for shell metacharacters such as ';', '|', '`', '$(', or '&&', followed by common binary execution commands (e.g., cat, wget, curl, bash, rm). This behavior is indicative of an exploit attempt targeting CVE-2026-39808.
Detects a sequence of events where a potential multimedia lure (PDF, image, or media file) is created or downloaded via a web browser or communication client, followed by an AI agent (e.g., ChatGPT, Claude) accessing the file, and subsequently initiating a shell execution process (PowerShell, CMD, etc.) involving suspicious command-line patterns or references to the original file. This behavior is indicative of an AI-assisted prompt injection attack where malicious content is processed and executed through agent tooling.
This rule detects potential AI prompt injection attacks delivered via email. It identifies users clicking external links directed at AI platforms (like OpenAI, Claude, or Perplexity) that contain suspicious URL parameters or instructions designed to manipulate or override the AI's standard behavior. It correlates the web request with a subsequent process execution on the host that includes suspicious keywords in the command line, suggesting an attempt to automate or exploit the AI assistant through local system interaction.
Detects potential supply chain or local configuration tampering involving the Model Context Protocol (MCP). The rule identifies modification of common MCP configuration files, followed by the execution of a tool runner (node, python, npx) that spawns a scripting shell, which subsequently initiates an unusual outbound network connection.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
Detects potential remote code execution triggered by loading untrusted AI model files (e.g., pickle, .pt, .pth, .ckpt) in Python-based environments. The rule identifies suspicious child process execution or the presence of known dangerous deserialization/payload indicators (like os.system, subprocess, or socket) within the command line of common model-loading applications, suggesting a model-based supply chain compromise.
Detects suspicious command-line execution patterns originating from explorer.exe, characteristic of 'ClickFix' social engineering attacks where users are tricked into copying and pasting malicious commands into a terminal or Run dialog. The rule monitors for the usage of system binaries (mshta, powershell, rundll32, etc.) combined with network-fetching arguments or suspicious execution flags (hidden windows, encoded commands).
Detects the execution of attrib.exe spawned by known Sauron Loader process names (rnpkeys.exe, rnp.exe, or tdwp.exe). The rule flags instances where attrib.exe is executed without its typical command-line arguments (file attribute flags), suggesting it is being used as a surrogate process for injected C2-tasked shellcode.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
This rule detects the presence of command line artifacts, filenames, and strings associated with the SilverFox malware. These strings indicate the execution of a malicious desktop monitoring component ('active_desktop_launcher.exe') or the use of specific IPC/configuration markers ('@@RAPID_CFG_START@@') characteristic of this threat's tradecraft.
Detects instances where a command-line utility or scripting interpreter references a 'SKILL.md' configuration file, typically associated with agent-skill payloads, followed shortly by network-based file download activity. This behavior is indicative of a secondary payload retrieval triggered by an adversary-controlled or poisoned configuration file.
Detects a sequence of activity indicative of destructive ransomware or wiper behavior on a Windows device. The rule correlates a high volume of file modification, creation, or rename events within a short timeframe with concurrent attempts to delete or modify Windows backup and recovery mechanisms (such as Volume Shadow Copies or Boot Configuration Data) using native administrative utilities.
Page 10 of 154