Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
811 detections
Filters
Last updated
All Time
Detection languages
339
195
76
50
47
Contributors
208
105
95
70
69
Categories
492
482
95
95
87
Platforms
626
161
82
25
5
Products / Services
203
160
110
86
67
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
811
CVEs
6
6
5
5
5
IDS Classtypes
20
2
2
1
IDS Protocols
20
3
Detects execution of shell commands interacting with busybox (e.g., 'cat /bin/busybox'). This behavior is used by the Nexcorium Mirai variant to verify shell functionality after a successful Telnet brute-force attack.
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
Detects HTTP requests containing the VS/PL/AN parameter combination used by JanelaRAT for C2 beaconing. The beacon reports malware version (VS), profile level (PL), and presence of banking security software (AN). JanelaRAT targets Latin American financial institutions (Brazil, Mexico). Note: C2 uses port 443 WITHOUT TLS encryption.
Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information.
This process is primarily used to detect and avoid virtualization and analysis environments.
This process is primarily used to detect and avoid virtualization and analysis environments.
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Detects installation and post-installation activity associated with OpenClaw and its known variants — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for npm global install commands, execution of shell installer scripts, OpenClaw-related binary or package files written to disk, and outbound network activity originating from known OpenClaw agent processes. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
This rule detects potential persistence mechanisms used by the AMOS malware on macOS systems. Specifically, it looks for the creation or execution of a launch daemon named 'com.finder.helper' in conjunction with other suspicious activities such as the execution of '.agent' or '.mainhelper' files, or commands used for user context pivoting . The rule also includes checks for VM detection attempts using 'system_profiler'. This combination of activities indicates a high likelihood of AMOS malware establishing persistence and attempting to escalate privileges or gather system information.
Detects network communication patterns associated with EtherRAT, including beaconing to 'aurineuroth.com' and CDN-like URLs. Additionally, it identifies host-based fingerprinting activities often performed by EtherRAT, such as hidden PowerShell execution, discovery of MachineGuid, antivirus product information, domain membership, and video controller details, as well as the creation of 'svchost.log' in AppData.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. This technique is often used by malware, such as EtherRAT's SYS_INFO module, to map defensive tooling and understand the security posture of a compromised system.
This rule detects a suspicious sequence of events indicative of the Albabat malware. It looks for instances where a device performs WMI-based reconnaissance (querying CPU, csproduct, OS, or NIC information) followed by or preceded by network communication with either a GitHub repository containing 'billdev' or a Supabase instance. The time window for these events is set to 30 minutes, suggesting a contextual link between the reconnaissance and subsequent network activity.
Detects the execution of multiple system reconnaissance commands concatenated into a single command line. This behavior is characteristic of the LAMEHUG malware, which uses LLMs to dynamically generate these command strings.
This rule detects command-line access to cloud metadata services from utilities such as curl, wget, busybox, or python. It specifically looks for command lines containing IP addresses or hostnames commonly associated with cloud metadata endpoints (e.g., 169.254.169.254, metadata.google.internal, 100.100.100.200) or metadata paths (e.g., /latest/meta-data, /computeMetadata/v1/). This is a hunting rule designed to identify unusual process activity that might indicate a cloud-aware malware framework attempting to discover cloud environment details.
Detects the creation of the '___unique_id___' file in a temporary directory. This file is a specific artifact used by the PeckBirdy JScript framework to store a persistent victim identifier.
Detects a sequence of events associated with a malicious Notepad++ update. This malicious process executes reconnaissance commands.
This rule detects the execution of reconnaissance commands (whoami, tasklist, systeminfo, netstat) via `cmd.exe` where the parent process is either `GUP.exe` or `AutoUpdater.exe`. This behavior is indicative of the Notepad++ supply chain attack, where malicious updates could execute system reconnaissance commands. The detection specifically looks for output redirection, which is a common technique for adversaries to save command output.
Page 29 of 39