Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the execution of malicious LNK files (masquerading as image files) that trigger PowerShell scripts, or the subsequent execution of non-Microsoft signed Node.exe binaries from suspicious directories, characteristic of the TonRAT campaign.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with command-line arguments that indicate an output file ending in '.zip' and a URL, followed by a file creation event for a '.zip' file.
Detects suspicious activity originating from web application processes (python, uvicorn, gunicorn) involving the download and execution of a payload (isp.sh), followed by the deployment and execution of a binary (lambsys) within hidden directories in /var/tmp/. This rule flags indicators of compromise such as curl/wget calls to suspicious IPs, creation of hidden directories, and execution of binary files in temporary storage locations.
Detects usage of the Windows certutil.exe utility with flags commonly associated with malicious activity, including downloading files from remote URLs or decoding/encoding files within temporary or application data directories.
Detects a suspected malicious activity sequence where PowerShell is used to download the cloudflared utility from GitHub, followed by a silent MSI installation of cloudflared. This sequence is indicative of post-exploitation activity often associated with Bumblebee malware leading to the establishment of covert C2 tunneling, frequently observed in Akira ransomware intrusion chains.
Detects the installation of 'cloudflared.exe' as a Windows service from a non-standard file path. The rule specifically correlates this service installation with preceding PowerShell commands typically used to download remote files, consistent with tradecraft observed in Akira and Bumblebee campaigns to establish covert C2 tunneling.
Detects the abuse of the legitimate Windows utility certutil.exe to download files or perform encoding/decoding operations. These techniques are commonly used by attackers to stage malicious payloads, obfuscate files to bypass security controls, or retrieve additional malware components in multi-stage loader chains.
Detects the abuse of the legitimate Windows utility certutil.exe to download files or perform encoding/decoding operations. These techniques are commonly used by attackers to stage malicious payloads, obfuscate files to bypass security controls, or retrieve additional malware components in multi-stage loader chains.
Detects the installation of the Cloudflare Tunnel (cloudflared) utility as a Windows service, often used by threat actors to establish persistent, outbound command-and-control (C2) channels that bypass standard network perimeter controls. This rule monitors for PowerShell-based downloads from GitHub, silent MSI-based installation, and the execution of the 'service install' command.
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
Detects execution of AryStinger or JDY malware as a secondary payload on Oracle PeopleSoft servers, likely following exploitation of CVE-2026-35273 by ShinyHunters. The rule monitors for processes matching these names or anomalous binaries spawned from within the PeopleSoft application directory that are not part of the legitimate application service suite.
Detects network communication to the Sapphire Sleet C2 server used in the easy-day-js npm supply chain compromise. The dropper contacts 23.254.164.92:8000 to download second-stage payloads after disabling TLS certificate verification.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects the use of the native Windows tar.exe utility to silently extract ZIP archives into the AppData directory. This behavior is associated with the Potemkin Loader, which often uses this technique to stage malicious payloads after downloading them.
Detects the use of BITSAdmin to download files from remote URLs. Attackers frequently abuse BITSAdmin, a legitimate Windows administrative tool, to download malicious payloads or secondary tools from external servers.
Detects instances where the Windows script hosts wscript.exe or cscript.exe establish outbound network connections to common web ports (HTTP/HTTPS) on external IP addresses. This behavior is frequently associated with script-based malware, droppers, or C2 beacons.
Detects the use of curl.exe to download the Python embeddable zip file directly into the C:\Users\Public directory, indicative of NarwhalRAT staging.
This rule monitors for the creation of .exe or .msi files within common user-writable directories (Downloads, Temp, AppData) initiated by web browser processes (Chrome, Edge, Firefox, Brave). This behavior is often indicative of drive-by downloads or users interacting with malicious web content that delivers installers to the host.
This rule detects a sequence of suspicious activities on macOS: downloading a file from a potentially malicious source using curl, mounting a disk image using hdiutil, and subsequently opening files from the mounted volume. This pattern is commonly associated with the delivery and execution of malicious payloads, such as trojanized software or malware installers.
Page 63 of 121