Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
This rule detects suspicious PowerShell activity that involves hidden windows, execution policy bypass, and attempts to download or execute files. It specifically looks for PowerShell processes launched by common parent processes like explorer.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, or rundll32.exe, combined with command-line arguments indicative of stealthy execution and payload delivery. The rule identifies two main scenarios: 'Hidden Downloader and Execution' where PowerShell is used with hidden window styles and download commands, and 'Inline Launcher and Payload Delivery' where PowerShell is used with no profile and download/execution commands.
Detects attempts to perform Indirect Prompt Injection (IDPI) by embedding malicious instructions for AI agents or Large Language Models (LLMs) within web content. This rule identifies when common prompt injection keywords are present in conjunction with CSS techniques used to hide the text from being rendered in a browser, a method used to evade human review while targeting automated systems.
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google WinRAR CVE-2025-8088 Exploitation. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: WinRAR launching a command shell or scripting engine. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar- vulnerability) to document where the indicator came from and to support incident notes and reporting.
Detects the Apache ActiveMQ process (java.exe or wrapper.exe) spawning a command shell or web utility. This behavior is a strong indicator of post-exploitation activity following the exploitation of vulnerabilities like CVE-2023-46604, often used as an entry point for ransomware like LockBit 5.0.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google WinRAR CVE-2025-8088 Exploitation. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: WinRAR launching a command shell or scripting engine. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar- vulnerability) to document where the indicator came from and to support incident notes and reporting.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
This rule detects activity related to the EmEditor watering hole attack, specifically looking for PowerShell execution making requests to known malicious lookalike domains and network connections to the associated infrastructure. A match suggests a potential download of malicious code during what appeared to be a legitimate install or update. Investigation should focus on identifying the host, user, source of activity, and legitimacy of the install source, followed by evidence preservation, credential reset, and a search for follow-up malicious activity.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
Detects suspicious Claude Code configuration keys linked to automatic hook execution or automatic MCP server enabling, which were used to bypass consent and execute commands.
Detects a Java process starting certutil to download a file from the internet. This is unusual for a message broker and can indicate a server has been taken over and is pulling down a payload.
This detection identifies activity related to .NET Process Hollowing, specifically focusing on the use of InstallUtil.exe as the target process. It triggers when InstallUtil.exe attempts to access a source image located in a user's AppData or Temp directory, with a file extension of .exe or .bin. This behavior is indicative of a specific threat intelligence report detailing process hollowing techniques involving InstallUtil.exe. A match suggests a strong reason for investigation, as it aligns with published threat reporting, though it does not confirm compromise or success of the activity.
Detects instances where an npm or node process spawns a shell, which in turn executes a command-line networking utility like curl or wget. This behavior is indicative of a malicious pre/post-install script used in supply chain attacks, such as the one seen with the 'ambar-src' package.
This rule identifies various activities associated with the Dohdoor malware campaign, combining multiple detection heuristics into a single result set. It looks for PowerShell executing curl to download batch scripts, copied Windows tools run from shared folders with unusual arguments, suspicious DLL loads from shared folders, and network connections to C2-style domains identified in the campaign.
Detects the execution of iptables to set the default policy for a chain (INPUT, OUTPUT, or FORWARD) to ACCEPT. This technique was used by a stager in a campaign delivering the Rekoobe backdoor to weaken the host's firewall posture and ensure C2 communication.
This rule detects various stages of an attack chain, starting from an Apache ActiveMQ exploit (CVE-2023-46604) leading to LockBit-style ransomware. It identifies process creation anomalies (java.exe spawning certutil.exe for downloads), network connections to known Metasploit C2 infrastructure, the presence of specific ransomware file hashes, and attempts to clear Windows event logs, all indicative of the described attack scenario.
Detects Claude Code spawning suspicious child processes, consistent with abuse of project configuration hooks or MCP initialisation commands.
Detects a Java process starting cmd or PowerShell. On an ActiveMQ server this can indicate that someone is running commands after exploiting the service.
Detects Office applications spawning scripting engines or LOLBINs often used in multi stage delivery chains associated with Agent Tesla style campaigns.
This rule detects activities related to the DKnife gateway, which is associated with Adversary-in-the-Middle (AitM) attacks. It identifies the creation of specific DKnife process names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin), file events involving DKnife configuration artifacts (rules.conf, sslmm.cfg, url.cfg), and the presence of specific marker strings ("dkimsi=", "460110672021628", "PASSWORD") in logs or captured payloads. The rule aims to identify the presence and activity of DKnife components on Linux systems.
Page 119 of 154