Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects suspicious commands being set in the RunMRU registry key by explorer.exe. It specifically looks for the presence of LOLBins such as powershell, mshta, and curl, as well as obfuscation techniques like caret (^) and ProxyCommand, or patterns indicative of encoded/script execution (e.g., Invoke-Expression, FromBase64String, -eC). This activity is associated with the 'ClickFix' social engineering technique.
This rule detects patterns associated with the Yellow Cockatoo RAT, specifically looking for process creation events where an interpreter is executed with command-line arguments containing both XOR encoding indicators and references to shortcut files ('.lnk') for potential persistence or execution.
This rule detects the execution of script hosts (PowerShell, wscript, cscript) that are launched by either the Windows Run dialog (rundll32, dllhost) or common web browsers (Chrome, Microsoft Edge, Firefox). The script host execution is further narrowed down by looking for command-line arguments indicative of script execution, such as encoded commands or invocation of functions like 'Invoke-' or 'IEX('. This pattern is often associated with the 'ClickFix' social engineering technique where users are tricked into pasting malicious commands into the Run dialog or clicking links that trigger script execution from a browser.
This rule detects the KongTuke second-stage PowerShell loader. It specifically looks for PowerShell scripts that attempt to read a payload from a file named 'Remove-NetNatStaticMapping.log', decrypt it using DPAPI (Data Protection API) via 'ProtectedData]::Unprotect' and 'DataProtectionScope]::Localmachine', and then execute the decrypted content using an 'iex' alias. The script also includes references to 'Add-Type -AssemblyName System.Security' and 'AppActions', indicating advanced PowerShell capabilities and potential interaction with application-related data. The use of 'ReadAllBytes' and 'UTF8.GetString' suggests the payload is read as raw bytes and then converted to a string for execution.
Detects Chromium-based browsers (e.g., Microsoft Edge, Google Chrome) being launched with specific command-line arguments that attempt to hide the browser window (headless mode or positioning it off-screen).
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
Detects instances where the Windows 11 Notepad process (Notepad.exe) spawns unexpected child processes. This behavior is a primary indicator of the CVE-2026-20841 exploitation via malicious Markdown links, which allows for remote code execution.
Detects XWorm V6 infection chain where wscript.exe spawns powershell.exe executing a .ps1 with Start-Process powershell
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects when a VM Run Command is executed successfully, followed by the VM's Managed Identity authenticating to Azure Resource Manager. This pattern may indicate an attacker using Run Command to steal MI tokens for lateral movement.
Detects suspicious process execution patterns indicative of the ClickFix / CrashFix Python RAT. This rule specifically looks for 'finger.exe' or 'powershell.exe' with encoded or obfuscated commands, especially when initiated by common browser processes or explorer.exe, which aligns with social engineering techniques involving malicious copy-pasting.
Detects a sequence of events associated with a malicious Notepad++ update. This malicious process executes reconnaissance commands.
This rule detects the execution of command-line interpreters (bash, powershell, cmd, python) that include commands for invoking expressions or downloading content (invoke-expression, curl, wget, Invoke-WebRequest) AND contain specific keywords associated with AI agents (moltbot, openclaw, clawdbot). This combination suggests an AI agent potentially executing arbitrary or malicious commands, possibly as a result of prompt injection or an unusual script execution scenario.
This rule detects the execution of known webshells such as Behinder, Neo-reGeorg, Godzilla, or reGeorg. The detection is specifically triggered when these webshells are found in the command line of a process whose parent process is a common web server application like w3wp.exe (IIS), httpd.exe (Apache), nginx.exe (Nginx), or java.exe (often used for Java-based web servers like Tomcat). This indicates potential webshell deployment and execution on a web server, which is a critical indicator of compromise, often associated with initial access or persistence by attackers.
This rule detects the execution of 'node' with 'install' and 'openclaw' in its command line, or any process command line containing 'https://openclaw.ai/install.'. This indicates an attempt to install or execute the 'openclaw' tool, potentially for malicious purposes or unauthorized software deployment.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detects the execution of 'finger.exe' or 'ct.exe' with command-line arguments indicating an attempt to start 'cmd.exe', correlated with network connections to a known malicious IP address (69.67.173.30). This behavior is indicative of LOLBIN (Living Off the Land Binaries and Scripts) abuse for command and control communication.
This detection identifies potential abuse of the Windows Package Manager (winget.exe) for malicious activities, including arbitrary command execution, execution from temporary directories, suspicious network egress, and installation of unsigned binaries from non-admin accounts.
This rule detects the execution of reconnaissance commands (whoami, tasklist, systeminfo, netstat) via `cmd.exe` where the parent process is either `GUP.exe` or `AutoUpdater.exe`. This behavior is indicative of the Notepad++ supply chain attack, where malicious updates could execute system reconnaissance commands. The detection specifically looks for output redirection, which is a common technique for adversaries to save command output.
Detects creation of malicious Lua script files in AppData\Roaming\Adobe\Scripts directory used in infection chain.
Detects suspicious PowerShell execution initiated by explorer.exe, specifically when the command line includes a .lnk file, execution policy bypass, and contains keywords or paths commonly associated with malicious activity (e.g., tor, ssh, github.io, dropbox.com, or suspicious temporary/public directories). This pattern is often observed in initial access or execution phases of attacks.
This rule detects suspicious process creation patterns where a Java or Tomcat process (common in Ivanti EPMM) spawns a command shell (cmd.exe, bash, sh) or a process containing 'sliver' or 'implant' in its command line. This behavior is indicative of potential Remote Code Execution (RCE) abuse, particularly in the context of Ivanti EPMM vulnerabilities.
Page 121 of 154