Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the execution of the windowless Java runtime (javaw.exe) originating from the C:\ProgramData\ directory. Threat actors, such as those deploying Nimbus RAT, often drop a bundled Java Runtime Environment (JRE/JDK) in ProgramData to evade detections that monitor standard Java installation paths.
Detects instances where node or Electron processes are executed with the ELECTRON_RUN_AS_NODE environment variable set to 1. This technique is used by UNK_DeadDrop to turn an editor into a plain Node.js interpreter for stealthy payload execution.
Scripting Interpreter Exec
Cortex XDR
This rule detects suspicious command execution patterns on Linux systems involving scripting interpreters. Specifically, it looks for these interpreters being invoked with command-line arguments that suggest direct execution of code. This pattern is commonly associated with web shell activity, reverse shells, or other forms of arbitrary code execution.
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory. This is indicative of a Dead Drop Resolver (DDR) technique utilized by the Gamaredon group to retrieve Command and Control (C2) configuration data.
Detects the specific command line arguments used by Payouts King ransomware, specifically requiring the mandatory execution trigger parameter '-i' alongside at least one of the obfuscated behavior flags: '-noelevate', '-nohide', '-nopersist', or '-note'. This combination is highly indicative of Payouts King ransomware execution.
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
This rule detects when a web browser initiates the execution of an executable (.exe), dynamic link library (.dll), JavaScript (.js), or VBScript (.vbs) file. This behavior can be indicative of malicious activity such as drive-by downloads, phishing attacks leading to malware execution, or exploitation of browser vulnerabilities.
Detects the execution of the 'tee' command via sudo, potentially indicating local privilege escalation. This activity has been observed in VerdantBamboo campaigns exploiting a sudo misconfiguration for the 'egnyteservice' account on Egnyte Storage Sync systems.
Monitors the IIS worker process (w3wp.exe) for the execution of suspicious child processes such as cmd.exe, powershell.exe, and whoami.exe. This behavior is commonly associated with post-exploitation reconnaissance and execution via web shells, including those deployed during KnowledgeDeliver ViewState deserialization attacks.
Detects the specific sequence of commands used in the ClickFix FakeCaptcha attack, moving a ZIP from Downloads, extracting it via tar, and silently executing a batch file. This rule looks for `cmd.exe` processes that contain `move`, `Downloads`, `tar`, `start`, `-xf`, and `/min` in their command line, along with specific payload filenames like `update.zip`, `u.zip`, or `update.bat`.
Detects the execution of a malicious Java process spawned by the Metasploit Confluence plugin, which is often used for remote code execution (RCE) via Confluence vulnerabilities. The rule looks for java.exe spawned from the Confluence directory with specific command-line arguments containing a classpath pointing to the user's Temp folder with a ~spawn prefix and a Payload class.
Detects the execution of the 'MicrosoftSystem64' RAT binary across Windows, macOS, and Linux operating systems. This specific malware is associated with the FAMOUS CHOLLIMA threat group, which is linked to DPRK, and is known to deploy a Node.js SEA RAT that exfiltrates data to HuggingFace.
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This technique is used by the SStar Agent RAT for its remote 'type' functionality.
Detects PowerShell utilizing Invoke-WebRequest (iwr) to download a payload and subsequently executing it via Start-Process using rundll32 with the specific 'Begin' export function. This execution pattern is the primary secondary stage for the recent Ghost CMS ClickFix campaigns delivering information stealers.
Detects multiple attempts at command injection through IIS web server URI queries. The rule looks for common command execution functions like 'eval(', 'system(', or 'exec(' within the 'csUriQuery' field of W3C IIS logs. A threshold of 3 or more attempts from the same IP within an hour triggers the alert.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
This rule detects repeated execution of commands containing both 'version' and 'control' keywords within the command line. It specifically looks for at least 5 such executions within a one-hour window on the same computer by the same account. This pattern could indicate an adversary attempting to enumerate system or software versions, or interact with version control systems, potentially as part of reconnaissance or privilege escalation.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
Identifies npm or node executing lifecycle scripts (e.g., preinstall) for known malicious typosquatted packages. This campaign utilizes these hooks to silently execute a stage-2 credential harvester targeting cloud environments.
Detects the execution of mshta.exe fetching a .7z payload from a remote URL, as observed in ClickFix campaigns delivering AnimateClipper.
Page 110 of 154