Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects when a common web server process (node, nginx, apache, apache2, httpd) spawns `curl` or `wget`. This behavior is a strong indicator of post-exploitation activity, as seen in the exploitation of vulnerabilities like CVE-2025-55182 (React2Shell), where attackers download second-stage payloads.
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
Detects Indicators of Compromise (IOCs) associated with React2Shell (CVE-2025-55182) exploitation attempts. This includes network connections to known malicious IP addresses, DNS queries for attacker-controlled domains, process creations involving suspicious command-line arguments (often related to downloading or executing scripts/binaries), and file hashes of known malicious artifacts. The exploit activity is linked to C2 communication, data exfiltration, and potentially cryptomining activities.
Detects PowerShell being used with an encoded command that contains download and execution primitives. This is a common technique used by adversaries, including in the exploitation of CVE-2025-55182 (React2Shell), to download and run second-stage payloads in memory.
Detects a PowerShell process that downloads a ZIP archive and extracts it to the ProgramData directory. This behavior is characteristic of the final stage of the JS#SMUGGLER campaign, which uses this technique to deploy the NetSupport RAT.
Detects Windows Script Host (wscript.exe or cscript.exe) execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges, APIPA, and local loopback. Threat actors frequently use raw or hex IP literals to bypass domain-based filtering and deliver payloads via script-based loaders.
Detects PowerShell command lines that reference HTTP/HTTPS content together with environment-backed AppData or Temp paths (e.g. %APPDATA%, $env:APPDATA, %TEMP%, $env:TEMP), a common pattern for downloading or staging payloads in user-writable directories.
Detects PowerShell (powershell.exe or pwsh.exe) execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges. Threat actors commonly use raw or hex IP literals to avoid domain filtering and deliver staged payloads.
Detects mshta execution where an HTTP/HTTPS URL targets a host expressed as a dot-quad IPv4 address or hex-encoded IPv4 address, excluding RFC1918 private address ranges. Threat actors frequently use raw or hex-encoded IP literals to evade domain filtering and deliver malicious HTA payloads.
Detects cmd.exe execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges. Threat actors commonly use raw or hex IP literals to avoid domain filtering and deliver staged payloads.
This rule detects command-line activity indicative of downloading payloads from a Cloudflare Tunnel (`.trycloudflare.com`). This technique is used by the SERPENTINE#CLOUD threat actor to deliver malicious stages of their attack chain. The rule looks for common download utilities or specific WebDAV paths being invoked by command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe.
Detects HTTP/HTTPS communication to known FlexibleFerret payload hosting domains.
Detects a PowerShell script that uses Invoke-WebRequest with custom headers to download a file, which is then executed via Start-Process. This technique is used by malware to bypass simple network filtering or for C2 authentication. It was observed in a campaign delivering multiple RAT families including AsyncRAT, DCRAT, and PUREHVNC.
Detects the execution of the UnRAR utility with a password to extract an archive. This technique is used by threat actors like the Kimsuky group and XWorm RAT to deliver malicious payloads.
Detects behaviors associated with the LCRYX VBScript ransomware, including modification of the hosts file to block security sites and the download of additional malicious payloads from known malicious URLs.
Detects network connections to Pastebin.com from a Python process. This behavior is associated with the InvisibleFerret malware, as part of the 'Contagious Interview' campaign, which retrieves additional payloads from Pastebin.
Detects network connections from Node.js to specific JSON storage services known to be abused by the 'Contagious Interview' campaign. Threat actors host malicious code on these services, which is then fetched and executed by trojanized applications as part of a social engineering scheme.
Detects FileFix campaigns that use clipboard manipulation functions in web pages to deliver malicious PowerShell commands. These campaigns often trick users into copying and executing payloads, sometimes involving steganography with image files.
Detects the use of a PowerShell download cradle, a technique observed in the PhantomCaptcha campaign to download and execute a next-stage payload. This pattern often involves stealthy flags to evade detection.
This query detects execution of processes related to Visual Studio Code extension signing or caching that involve known Glassworm-compromised extensions. Based on indicators published by KOI (October 20, 2025), it identifies suspicious .vsix package operations potentially associated with self-propagating malicious VSCode extensions observed in OpenVSX and Microsoft VSCode marketplaces.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
To extract vscode extension version I used this the https://detections.ai/rules/924f7b5f-d8df-4eed-ba06-08c657f65891.
Finger.EXE Execution
Sigma
Detects execution of the "finger.exe" utility.
Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon.
Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.
Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon.
Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.
Page 97 of 121