Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects non-standard processes (e.g., command shells, script hosts) loading WinRT notification and push app libraries (wpnapps.dll, notificationcontroller.dll), which may indicate an implant or script attempting to send spoofed toast notifications for social engineering.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
Detects the unexpected installation of Node.js by an unusual parent process (such as VS Code, cmd, or PowerShell). This behavior is indicative of the StoatWaffle downloader, which automatically fetches and installs the Node.js runtime if it is absent from the target environment.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This rule detects PolyShell webshell activity on Linux systems, specifically targeting Magento e-commerce platforms. It identifies processes executing from or targeting a suspicious media directory (`/var/www/prod/shared/pub/media/custom_options/quote/i/n/`) in conjunction with `curl` processes retrieving payloads from the `gsocket.io` C2 network. The detection logic combines indicators of webshell presence (execution from a specific directory) with C2 communication (curl to gsocket.io).
Detects the execution of a binary from the path /tmp/pglog, which is used as a
dropper location by the malicious sysmon.py script associated with the TeamPCP
Trivy supply chain malware.
dropper location by the malicious sysmon.py script associated with the TeamPCP
Trivy supply chain malware.
This rule detects suspicious activity involving the WebDAV client, specifically looking for scenarios where WebDAV connections to public IPs are initiated from a process that has recently modified the RunMRU registry key to include WebDAV parameters and executables like 'cmd' or 'net use', and has also accessed clipboard data. This combination of behaviors suggests potential credential theft or lateral movement attempts using WebDAV.
This rule detects the execution chain associated with MicroStealer, specifically looking for processes named 'RocobeSetup.exe', 'Game Launcher.exe', or 'miicrosoft.exe' that are involved in actions related to a file named 'soft.jar'. This indicates the potential presence and activity of the MicroStealer malware.
This rule correlates the creation of a potentially executable or script file by a browser or Microsoft Office application with its subsequent execution within a short time frame. This pattern is highly indicative of a user being tricked into downloading and running a malicious payload, often associated with initial access techniques like spearphishing with malicious attachments.
Detects 'Early Bird' Asynchronous Procedure Call (APC) injection into 'explorer.exe' processes. This technique involves a suspicious parent process (like a script interpreter) creating a suspended 'explorer.exe' process, then injecting malicious code using API calls such as 'QueueUserAPC' and 'WriteProcessMemory' before the process fully starts. This rule specifically looks for the combination of these events within a short timeframe.
Detects when 'Cursor.exe' (a legitimate application) spawns common command-line utilities (cmd.exe, powershell.exe, pwsh.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe) with command-line arguments indicative of downloading files from the internet (e.g., containing 'http://', 'https://', 'ftp://', '-o', '-OutFile', 'iwr', 'DownloadString', 'DownloadFile'). This could indicate malicious activity where 'Cursor.exe' is being abused to facilitate ingress tool transfer or execute malicious payloads.
This rule detects the presence of files on endpoints that match a list of known malicious SHA256 hashes associated with the Nuso malware. It queries DeviceFileEvents to identify any file with a matching hash.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
Detects curl or wget commands fetching scripts from vercel.app or URL shorteners and piping to shell execution, consistent with Contagious Interview initial access.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
detects BPFDoor .lock and .pid files access in temporary file storage facility
This rule detects suspicious command-line activity indicative of SSH tunneling, external IP checks, and reconnaissance commands. It looks for specific IP addresses associated with known C2 or SSH tunnel infrastructure, SSH command-line options like 'StrictHostKeyChecking=no' and reverse tunnel flags ('-R', '-N'), the use of 'ifconfig.me' for external IP discovery, and various 'whoami' and 'groups' commands for system reconnaissance. It also flags activity related to 'FMAPP.exe' or 'FMAPP.dll'.
Detects execution of Warcode Crystal-based shellcode loader from common writable public directories used by APT36
Detects suspicious command interpreters and LOLBins written into the Explorer RunMRU registry key (commonly used for Run dialog history), with explorer.exe as the initiating process.
This rule detects PowerShell processes (powershell.exe, pwsh.exe, mbs.exe) that are executing commands to read the content of batch (.bat) or command (.cmd) files. This behavior has been observed in campaigns like Dead#Vax for self-parsing and in-memory payload extraction. The detection specifically looks for `Get-Content` or its alias `gc` within the PowerShell command line, targeting files with `.cmd` or `.bat` extensions.
This rule detects the creation of PowerShell aliases for high-risk cmdlets or .NET web client patterns. Adversaries may use 'Set-Alias' to create short, obfuscated aliases for common cmdlets like Invoke-WebRequest, Invoke-Expression, or cmdlets related to Defender tampering, making their command-line activity harder to detect and analyze. This detection focuses on the 'ProcessCreated' event for PowerShell processes where 'Set-Alias' is used to map to a predefined list of suspicious cmdlets or patterns.
Page 118 of 154