Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects cmd.exe launched from the Windows Run dialog (explorer.exe
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
Detects PowerShell using System.Net.WebClient DownloadFile or related commands to fetch tool dependencies (such as 7z, MSTSCLib, ffmpeg) from GitHub repositories associated with the 'websalat' naming convention, indicative of Salat Stealer or similar tool-loading activity.
Detects GitLab backend processes (such as puma, sidekiq, rails, ruby, bundle) spawning shells, scripting interpreters, or network tools with suspicious command-line parameters, potentially indicating post-exploitation activity or vulnerability exploitation.
Detects the creation of AI coding assistant configuration files (such as .cursorrules, CLAUDE.md) in user directories (Downloads, Desktop, Temp) by non-git processes, followed within a short time window by execution of interpreters or tools (like node, npm, powershell, cmd, curl) with suspicious command line parameters indicating possible download or script execution.
Detects web server processes (Apache httpd, apache2, php-cgi, php-fpm) spawning a Unix shell (sh, bash, dash) that executes a wget or curl command piped directly into the shell for execution, indicative of potential remote code execution or web shell activity.
Detects multiple distinct source IPs sending forged 'pitboss PPE' authentication failure messages to NetScaler authentication endpoints within a short timeframe, associated with a fetch-based FreeBSD payload download (kw2-freebsd-x64-s11).
Detects potential DLL sideloading of mscoree.dll outside of standard system and .NET paths, followed closely by network activity connecting to GitHub from the same process within a one-hour window.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Detects a PowerShell download-and-execute command referencing specific typosquatted lure domains (e.g., choclatey.org, massgravel.net) combined with follow-up script activity writing into a fake SystemHealth\Update directory.
The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\).
This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Box Shield Malicious Content Upload
Cortex XDR
Surfaces Box Shield malware detection alerts with file hash, upload path, source IP, and scan results for immediate correlation and threat response.
Detects the download of potentially suspicious executables, scripts, or archives originating from code hosting platforms like GitHub, GitLab, and various mirrors where files have low prevalence and lack valid signatures.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains.
It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services.
While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads.
This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain.
It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services.
While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads.
This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects instances where package managers (pacman, makepkg, yay, paru) or their children spawn a root shell that downloads and executes external scripts via curl or wget.
Page 2 of 121