Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects command-line executions that involve downloading content from the internet and immediately executing it. It specifically looks for `SecurityEvent` with `EventID 4688` (process creation) where the `CommandLine` contains keywords associated with web client operations (`IEX(New-Object Net.WebClient)`, `DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `curl.exe`) and also contains terms indicating a download and execute intent (`http`, `payload`, `execute`). This pattern is commonly used by adversaries for initial access, execution, and persistence.
Curl Download From Telegram Channel
Cortex XDR
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
Detects Unix shell commands executed via web application context
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
This rule detects the execution of 'python.exe' from within common Chromium-based browser application directories (Google Chrome, Microsoft Edge, Brave Browser). This activity is highly suspicious as Python should not legitimately execute from these paths under normal circumstances. Threat actors, such as UNK_DeadDrop, have been observed using this technique to bypass application-bound encryption path validation and steal sensitive data like browser credentials. Detection of this behavior indicates potential malicious activity, including credential theft or other forms of evasion.
This rule detects an unusually high number of process creations using 'RunAs' within a one-hour window by a single user. A count of 5 or more 'RunAs' commands within an hour could indicate an attempt at privilege escalation or lateral movement, potentially by an attacker trying to execute commands with different user contexts.
Detects the execution of taskkill.exe targeting the iediagcmd.exe diagnostic tool. This defense evasion action is performed by the PlugX payload prior to establishing a C2 communication channel to prevent network diagnostic monitoring.
Detects suspicious execution patterns indicative of ransomware utilizing batch scripts. This rule triggers when 'cmd.exe' or 'powershell.exe' execute at least 5 times within a 5-minute window, with command lines containing '.bat', '.cmd', or '/c', suggesting automated script execution often seen in ransomware attacks.
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
This rule detects the execution of package managers by common parent processes (code.exe, cmd.exe, powershell.exe) when they are used to install or add packages. It looks for package names that include scope (e.g., @scope/package), version numbers (e.g., package@1.2.3). This pattern could indicate an attempt to introduce malicious or unauthorized packages into a development environment or system.
This rule detects the creation of suspicious child processes by 'lsass.exe' on Windows systems. LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Under normal circumstances, LSASS should not spawn common command-line interpreters or system utilities like cmd.exe, powershell.exe, or rundll32.exe. Such activity is highly indicative of post-exploitation behavior, potentially following a successful compromise like the referenced CVE-2026-41089 Netlogon RCE, where an attacker might use LSASS to execute further commands or tools.
Detects the loading of known trojanized native extensions (.abi3.so files) used in compromised bioinformatics PyPI packages (like ensmallen) as part of the Miasma/Hades campaign. Specifically targets 'ensmallen_haswell.abi3.so' and 'ensmallen_core2.abi3.so'.
Detects outbound network connections to known Command and Control (C2) IP addresses associated with the OP-512 threat actor, which are used as fallback infrastructure, including Meterpreter. This rule specifically looks for connections to '43.160.202.246' and '140.206.161.227'.
Payload Ransomware Execution Flags
Cortex XDR
Detects the execution of a process using specific command-line flags associated with Payload ransomware's anti-forensic capabilities (e.g., --bypass-etw, -li).
cURL MSI Download and Execution
Cortex XDR
Detects the execution of cURL commands chained with msiexec to download and silently install an MSI package, a known tactic used by UNC3753 to deploy RMM tools like SuperOps.
Detects the execution of nested, hidden, and bypassed PowerShell sessions spawned by cmd.exe, typically launched from a Startup LNK file. This behavior is associated with the SHADOW-EARTH-066 campaign, which uses specific command-line arguments for evasion and loads payloads from C:\ProgramData\ using Invoke-Expression or iex.
Detects the specific ClickFix execution chain used to download, extract, and execute the MLTBackdoor payload via cmd, curl, tar, and rundll32. This rule identifies the execution of 'cmd.exe' with a command line containing a sequence of 'curl' for downloading, 'tar' for extraction, and 'rundll32' for execution, which is characteristic of the MLTBackdoor's delivery and execution mechanism.
Detects the specific ClickFix execution chain used to download, extract, and execute the MLTBackdoor payload via cmd, curl, tar, and rundll32. This rule identifies the execution of 'cmd.exe' with a command line containing a sequence of 'curl' for downloading, 'tar' for extraction, and 'rundll32' for execution, which is characteristic of the MLTBackdoor's delivery and execution mechanism.
This rule detects suspicious activity related to OpenSSL or certificate manipulation by identifying processes that execute commands containing 'openssl' or 'certificate' keywords. It aggregates these activities by computer and account within one-hour bins and flags if three or more such activities occur, which could indicate credential access attempts or system misconfiguration.
Detects exploitation of weak service file permissions for privilege escalation
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
Page 106 of 154