Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects script engines using common download or decoding primitives that frequently appear in staged malware delivery.
Detects a Windows program being run from a shared folder instead of its normal location, with an unusual command added. This can be a sign that a clean program was copied and used to run a harmful file.
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Detects common shell or script processes spawned by explorer.exe, which may indicate execution via the Windows Run dialog. This behavior aligns with ClickFix social engineering techniques and checks for suspicious command-line arguments tied to this pattern, often used to download or execute malicious code.
Detects when explorer.exe modifies a .lnk file immediately after a suspicious process (e.g., LOLBAS) is launched by explorer.exe on the same host. This behavior is a forensic artifact of advanced LNK spoofing techniques (Variants 3 and 4 from the referenced research) where Windows "self-repairs" an internally inconsistent shortcut file after its first execution.
Detects Windows PE files that contain string indicators associated with the Diaoyu loader as reported in the Shadow Campaigns research. The rule keys on multiple distinctive strings, including references to WordPress themed artefacts, a GitHub raw content host, and Diaoyu specific markers, and requires an MZ header plus either two or more indicators or specific high confidence string pairs.
https://www.bleepingcomputer.com/news/security/new-clickfix-attack-abuses-nslookup-to-retrieve-powershell-payload-via-dns/
This rule detects a multi-stage attack chain. The first rule identifies the Notepad++ updater (GUP.exe) spawning curl.exe to upload reconnaissance output to 'temp.sh/upload', indicating a potential supply-chain attack. The second rule detects the execution of 'ProShow.exe' from an unusual location within the AppData\Roaming\ProShow directory, which is part of a described execution chain. The third rule identifies the execution of 'script.exe' with 'alien.ini' from the AppData\Roaming\Adobe\Scripts directory, matching another stage of the supply-chain attack.
Detects the execution of common Living Off The Land Binaries and Scripts (LOLBAS) initiated from Windows Explorer. The detection logic specifically looks for command lines that contain indicators of obfuscation or padding, which are common techniques used in malicious LNK (shortcut) files to hide their true purpose. This rule identifies processes like mshta.exe, powershell.exe, cmd.exe, certutil.exe, cscript.exe, and wscript.exe being launched by explorer.exe with suspicious command-line arguments.
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
This rule detects suspicious activity involving the Windows RunMRU registry key followed by a process launch. Specifically, it looks for modifications to the `RunMRU` registry key that contain certain suspicious strings (e.g., `nslookup`, `dig`, `powershell`, `cmd.exe`, `curl`, `wget`, `certutil`, `bitsadmin`, or various command-line obfuscation/download patterns). Subsequently, it correlates this registry modification with a process launch on the same host and by the same user, where the process command line also contains one of these suspicious strings. This behavior could indicate an adversary attempting to establish persistence or execute malicious commands.
This rule detects suspicious Python execution patterns that are commonly abused by attackers. It looks for Python interpreters executing commands inline, from user-writable paths (like AppData, Temp, Downloads), or using suspicious modules/functions (requests, socket, subprocess, base64, ctypes, urllib, exec, eval). Additionally, it identifies Python processes that include indicators of downloading or installing tools (pip install, wget, curl, powershell, bitsadmin). The rule filters out common development tools and system accounts to reduce false positives.
This rule detects attempts to download the 'clawd.bot' or 'openclaw.ai' installation scripts using various command-line tools. It specifically looks for the use of 'curl', 'wget', 'aria2c', 'fetch', 'powershell', 'pwsh', 'certutil', 'bitsadmin', or 'mshta' when their command lines contain either 'clawd.bot/install.sh' or 'openclaw.ai/install.sh'. This activity is indicative of potential malware deployment or initial access attempts related to the OpenClaw/Clawd threat.
This rule detects the execution of bash or sh scripts that contain specific keywords associated with the OpenClaw installation process. It looks for command lines that include "openclaw" along with other distinctive strings such as "run_remote_bash", "OPENCLAW_INSTALL_SH_NO_RUN", "OPENCLAW_USE_GUM", "All your chats, one OpenClaw", ".openclaw/openclaw.json", or "openclaw.ai/install.sh". This aims to identify potential OpenClaw installation attempts, even if the script itself has been renamed.
FileFix is a sophisticated social engineering attack, emerging in mid-2025, that abuses the Windows File Explorer address bar to execute malicious PowerShell commands. It is an evolution of the "ClickFix" technique, shifting from the Run dialog (Win+R) to the Explorer address bar (Ctrl+L).
Detects command injection related attacks with AI agents through suspicious prompt patterns or system command execution by AI processes.
This rule detects suspicious process creation events where `explorer.exe` (Windows Explorer) launches various scripting or utility executables (`powershell.exe`, `cmd.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, `installutil.exe`, `wmic.exe`, `certutil.exe`, `msdt.exe`). The detection is specifically triggered when the command line of the launched process contains indicators of network communication (e.g., `http://`, `https://`, `iwr`, `invoke-webrequest`, `curl`, `wget`, `bitsadmin`, `downloadstring`, `downloadfile`), encoded commands (`-e` or `-encodedcommand` with base64-like strings), or UNC paths (`\\`). It also specifically looks for `certutil` being used with `-urlcache`, `-decode`, or `-f` flags. The rule includes exclusions for common legitimate activities such as downloads from `chocolatey.org`, `nuget.org`, `aka.ms`, `cmd.exe` launching a browser to a URL, and `certutil -hashfile` operations.
Detects PowerShell downloading XWorm V6 binary from github.com, spawned by wscript.exe
This rule detects the execution of processes with command lines containing specific strings associated with the Diaoyu loader, a component of the Shadow Campaigns espionage activity. The rule looks for the presence of 'pic1.png', 'padeqav', 'admin-bar-sprite', or 'DiaoYu' within the command line arguments of newly created processes. This activity is linked to Unit 42 TGR-STA-1030.
Detects suspicious child processes spawned by sqlservr.exe, potentially associated with Trigona threat actor activity.
Page 120 of 154