Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
59
31
19
2
2
Contributors
20
16
12
11
10
Categories
57
54
14
14
11
Platforms
94
34
26
4
2
Products / Services
28
27
13
6
6
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
3
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
Detects installation of malicious "evil twin" Open VSX extensions impersonating AMD, Azure, or Salesforce that carry the tell-tale version 0.0.1 or 0.0.2, identified via file creation/write events in VS Code / Open VSX extension directories.
Detects the download, file creation, or execution of known NirSoft credential and browser harvesting utilities (ChromePass, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) from non-standard directories or identified malicious actor infrastructure.
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
This rule detects execution chains associated with the Quima RAT loader, specifically monitoring for VBScript-based child processes spawning suspicious command-line activity. This includes the use of certutil.exe to decode payloads, discovery commands like 'where javaw', and the execution of suspicious Java processes with specific arguments or paths indicative of malicious behavior.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects anomalous system reconnaissance and potential anti-VM sandbox evasion behaviors exhibited by processes. The rule aggregates distinct indicators such as system information gathering (systeminfo, wmic), virtualization environment probing (VMware Tools detection), registry-based identity checks (MachineGuid, ComputerName), and broad enumeration of HKLM\SOFTWARE vendor keys, identifying processes that perform three or more of these distinct actions within a 5-minute window.
Detects the BQT/start.exe loader exhibiting suspicious behavior indicative of sandbox or analysis environment evasion, including checking for common analysis tools, enumerating processes, or querying the registry for VMware-related artifacts.
Detects the execution of common system enumeration commands (process listing, network configuration, and system information) on Cisco SD-WAN infrastructure nodes. This activity is indicative of post-exploitation reconnaissance used by attackers to understand the system environment, network topology, and identify potential pivot points within the SD-WAN infrastructure.
This rule detects unauthorized modifications to Firefox registry keys related to the 'SmartWindow' AI feature, specifically identifying instances where the feature is silently enabled without user consent or where the SmartWindow endpoint and API key configurations are redirected to non-standard, potentially malicious URLs. It also monitors for Firefox process executions involving SmartWindow-related arguments, which may indicate exploitation of this browser-based feature.
Detects reconnaissance activities where known binary analysis tools or scripts scan the AnyDesk 9.7.6 runtime binary for specific PE markers (e.g., COM interface IDs, adprinterpipe string) associated with a known LPE vulnerability. This behavior indicates an attacker is fingerprinting the application to prepare for exploitation.
Detects the enumeration of installed security and monitoring software, such as Sysmon, Filebeat, and Microsoft Defender, using common system administration tools including sc.exe, tasklist.exe, wmic.exe, PowerShell, and reg.exe. This activity is often associated with reconnaissance performed prior to disabling security features on a compromised host.
This rule detects potential LegionLoader activity by monitoring for specific file staging in AppData/Roaming directories and suspicious registry queries related to security settings and Internet Explorer/Windows configuration values. The rule correlates process execution via msiexec.exe, rundll32.exe, or dllhost.exe with the creation of known staging artifacts and security-weakening registry modifications.
Hunting rule loosely based off of Atomic Red Team T1518.001 test "Get Windows Defender exclusion settings using WMIC". No public in-the-wild intel reference available; correlate before alerting.
Detects reconnaissance activities targeting binaries or modules containing libssh2 library references or specific PHP symbol offsets (e.g., zend_execute_internal, zif_system). This rule monitors for common administrative and debugging tools like ldd, strings, readelf, and nm being used to scan files for sensitive symbols or version information, as well as specific PHP enumeration patterns and validation script executions, which are commonly associated with the triage process for CVE-2026-55200.
Detects the Miasma malware attempting to enumerate installed developer and AI coding tools by executing version-check or help commands. The rule monitors for a pattern of 5 or more child process executions from 'node.exe' or 'bun.exe' within a 30-second window, which targets tools like VS Code, Cursor, Claude, AWS CLI, kubectl, helm, npm, git, and docker.
Detects reconnaissance activity where an attacker executes system discovery commands to identify the FreeBSD kernel version and kTLS configuration (specifically 'kern.ipc.mb_use_ext_pgs'). This enumeration is performed to fingerprint potential targets for the BUMSRAKETE exploit (CVE-2026-45257).
Hunting rule loosely based off of Atomic Red Team T1518.001 test "Get Windows Defender exclusion settings using WMIC". No public in-the-wild intel reference available; correlate before alerting.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Page 3 of 6