Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
KQL Query from file: Identity Blast Radius 2
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
KQL Query from file: APT Stealth Falcon - CVE-2025-33053 Detection
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query from file: Cookie-Bite Detection
KQL Query
KQL Query
KQL Query from file: BlueAlpha GammaDrop Detection
KQL Query from file: PowerShell Self-Pwn
KQL Query from file: Detecting Windows Downdate Abuse
Detects the use of GCC (or C89/C99) with the '-wrapper' option to execute a shell, which can be leveraged for privilege escalation, unauthorized command execution, or to break out from restricted environments. This technique is often documented in resources like GTFOBins.
Detects the use of the 'find' command in Linux to execute a shell. This behavior is often associated with privilege escalation, unauthorized command execution, or exploitation attempts, particularly when leveraging misconfigurations or vulnerabilities to break out of restricted environments.
Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign, often used with an append redirection operator ">>" to update file content indirectly. This technique can be used by attackers to append data to files, as demonstrated by the example: `cmd /c >> example.txt set /p="test data"` which appends "test data" to "example.txt". The rule specifically looks for `cmd.exe` executions containing `/c set /p=` or `"set /p=` or `>>*set /p=` in the command line.
This rule detects the execution of the 'capsh' utility followed by a double dash ('--'), which is a common pattern used to invoke a shell through 'capsh'. This technique can be used by adversaries to bypass restricted shell environments or escalate privileges by leveraging 'capsh' capabilities.
Detects the use of the 'env' command to invoke a shell on Linux systems. This activity can indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands by manipulating environment variables before launching a shell.
Detects the use of the "ssh" utility to execute a shell, which can indicate privilege escalation, unauthorized command execution, or breakout from restricted environments. The rule specifically looks for `ssh` commands that include `ProxyCommand=;`, `permitlocalcommand=yes`, or `localhost` in conjunction with common shell invocations like `/bin/bash`, `/bin/sh`, etc.
Detects the execution of 'awk' or its sibling commands (gawk, mawk, nawk) to invoke a shell using the `system()` function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. The rule specifically looks for 'git' as the parent process, combined with command-line arguments '-p' and 'help', and a child process command line containing 'bash 0<&1', 'dash 0<&1', or 'sh 0<&1'. This pattern is indicative of exploiting git's interactive help functionality to spawn a shell.
This rule detects the execution of inline Python code that uses the `os.system()` function to spawn a shell. Specifically, it looks for Python interpreter executables being run with the `-c` argument (for inline code execution) and the command line containing both `os.system(` and common shell paths like `/bin/bash`, `/bin/sh`, etc. This technique is often used by adversaries to gain interactive shell access or execute arbitrary commands on a compromised system.
This rule detects the manual execution of a script from inside a compressed file (ZIP/RAR) on Windows. It identifies scenarios where a user interacts with a compressed file, causing a script to be extracted to a temporary directory and then executed by common scripting interpreters like cscript, wscript, powershell, pwsh, or mshta. The rule covers execution initiated by 7zip, WinRar, or the native Windows File Explorer.
Detects the execution of mshta.exe to fetch and run remote scripts, a technique used by TAG-140 for initial access and loading the BroaderAspect loader and DRAT V2. This activity is often initiated via social engineering lures.
Page 132 of 154