Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects suspicious command-line arguments indicative of potential credential access attempts (cmdkey /list), or execution of hidden processes (excluding Java applications), or communication with a known malicious domain (staybud.dpdns.org).
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
This rule detects processes with a command line containing 'socket' and various cryptographic keywords (copy.fail, algif_aead, authencesn, hmac.*sha256.*cbc.*aes). This combination can indicate suspicious related to Copy Fail CVE-2026-3143
Identifies potential network tunneling, proxying, and reverse shell activities by correlating process creation with outbound public network connections. This rule looks for known tunneling and proxy tool filenames and specific command-line arguments indicative of such activities, then correlates these process events with successful or attempted outbound network connections to public IP addresses.
This rule detects commands executed on Linux systems to mitigate the 'Copy Fail' vulnerability (CVE-2026-31431) related to the 'algif_aead' kernel module. It specifically looks for the dynamic unloading of the module using 'rmmod algif_aead' or the configuration of 'modprobe' to prevent the module from loading by setting 'install algif_aead /bin/false' in a modprobe configuration file.
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
Detects when AI-integrated IDEs or coding agents spawn sensitive child processes such as command shells (cmd, powershell, pwsh) or web transfer tools (curl, wget). This behavior could indicate malicious activity if an attacker compromises the AI tool or if the tool itself is misused to execute arbitrary commands or exfiltrate data.
Detects command line execution indicative of the ToastNotify tool, which is used for weaponizing toast notifications. The rule specifically looks for the 'ToastNotify' string in the command line along with arguments like 'getaumid', 'sendtoast', or 'custom' followed by an XML file.
Susp AWK Command Execution
Gravwell
This rule detects suspicious execution of the 'awk' command on Linux systems. Specifically, it looks for 'awk' commands that include suspicious patterns. This pattern is often indicative of malicious script execution or code injection attempts using 'awk' for arbitrary command execution.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary command execution.
This rule detects attempts to modify GRUB configuration files using common text editors. Adversaries may modify GRUB configuration to establish persistence, disable security features, or alter the boot process for malicious purposes.
This rule detects the presence of suspicious script content (e.g., 'system(', 'exec(', '/dev/tcp/') within Python (.py) or shell (.sh) files located in common plugin directories on Linux systems. This could indicate an attempt to inject malicious code into package management configurations for persistence or privilege escalation.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary command execution.
This rule detects when an executable (.exe) is launched from the AppData\Roaming directory. This directory is often used by legitimate applications, but it is also a common location for malware to drop and execute itself. The rule excludes processes related to OneDrive and Teams to reduce false positives.
This rule detects when a Microsoft Office application (Word, Excel, PowerPoint) spawns a command interpreter (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This behavior is often indicative of malicious activity, such as macro-enabled malware attempting to execute commands on the system.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary code execution.
Detects the use of the Enable-WindowsOptionalFeature cmdlet to reactivate the deprecated and vulnerable SMB1Protocol. Attackers use this to facilitate lateral movement to legacy systems.
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
This rule detects the execution of an executable (.exe) file from a user's temporary directory (AppData\Local\Temp). This behavior is often associated with malware or suspicious activity, as temporary directories are frequently used by adversaries for staging and executing payloads. The rule specifically excludes executables with 'setup' in their command line to reduce false positives from legitimate software installations.
This rule detects instances where powershell.exe is launched by cmd.exe, and the command line does not contain 'system32'. This pattern can indicate an attempt to execute PowerShell scripts or commands from non-standard locations, potentially bypassing security controls or executing malicious code.
This rule identifies various indicators of Mimikatz execution, including specific command-line arguments, file names, suspicious access to the LSASS process memory, and the creation or loading of malicious services or DLLs associated with Mimikatz. It aims to detect credential dumping activities and persistence mechanisms often employed by attackers.
Page 113 of 154