Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects exploitation attempts against Oracle WebLogic servers by identifying HTTP requests that target known WebLogic administrative or internal endpoints and simultaneously contain indicators of command execution payloads within the URL. Specifically, it looks for URLs containing '/console/', '/wls-wsat/', '/bea_wls_internal/', or '/_async/' combined with keywords like 'cmd=', 'bash', 'powershell', 'wget', 'curl', 'base64', 'IEX', or 'Runtime.getRuntime'. The rule also requires the source IP to be different from the target IP, indicating an external attacker. This pattern is typical of Remote Code Execution (RCE) exploitation attempts, including those targeting vulnerabilities like CVE-2026-21962.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
This query hunts for suspicious child interpreter processes spawned by Node.js/npm execution, consistent with malicious npm postinstall activity observed in supply chain attacks (including compromised Axios package delivery chains).
Detects creation of known malicious files linked to axios compromise
Identifies the execution of PowerShell with suspicious base64 decoding activity.
This behavior is often observed during malware installation leveraging PowerShell.
This behavior is often observed during malware installation leveraging PowerShell.
This rule detects various indicators of compromise associated with the GlassWorm malware. It monitors for network connections to known GlassWorm remote IPs and domains, process activity involving specific GlassWorm filenames, folder paths, command line arguments (including wallet addresses and command terms), and registry modifications for persistence (Run/RunOnce keys with GlassWorm-related values). The rule correlates multiple evidence types to reduce false positives.
This rule detects potential abuse of Microsoft Excel where a process other than Excel itself is launched by Excel. This behavior can be indicative of malicious Excel add-ins (XLLs) or macros executing external code, a common technique used in phishing campaigns and malware delivery. The rule specifically looks for `excel.exe` as the parent process and a different executable (`ImageFileName`) as the child process.
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
This rule detects PowerShell processes executing commands that involve reading bytes from a .lnk file. This behavior is often associated with malware attempting to extract malicious content embedded within a shortcut file, potentially for further execution or to bypass security controls. The rule specifically looks for `powershell.exe` or `pwsh.exe` in the image filename or original filename, combined with command-line arguments containing both `.lnk` and `readallbytes`.
This rule detects the presence of specific 'NODE_CHANNEL' values ('anglmf', 'cryptoexth4', 'complexarchaeologist1') in process command lines or network event initiating process command lines on macOS systems. These values have been observed in the GhostClaw/GhostLoader malware campaign, indicating potential execution or network communication related to this threat.
Detects instances where dllhost.exe, which typically hosts COM objects, spawns suspicious child processes such as command shells, scripting interpreters, or reconnaissance tools. This behavior is highly indicative of COM object hijacking, process injection, or DCOM lateral movement with hands-on-keyboard activity.
Detects Node.js spawning shell processes which may indicate malicious npm package activity
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
Detects suspicious WebLogic HTTP requests with command execution indicators, specifically targeting known WebLogic endpoints and looking for patterns indicative of Remote Code Execution (RCE) payloads. The rule also correlates this activity with external IP addresses.
This rule detects an AMOS-style macOS AppleScript loader. It identifies a combination of execution chain strings. The rule requires a specific number of these elements to be present, along with a magic byte check or the string 'osascript -e'.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
Detects execution of processes from node_modules which may indicate malicious package behavior
Detects suspicious command-line arguments used with Windows utilities (LOLBAS), while excluding common legitimate Microsoft/Windows Update URLs.
Detects when a process spawned by Microsoft Office or a web browser executes a child process.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
This rule detects various activities associated with the Charon ransomware, including DLL sideloading, ransomware deployment, payload reading, ransom note creation, shadow copy deletion, and service creation for persistence. It leverages specific filenames, process behaviors, and registry modifications to identify the threat.
Page 117 of 154