Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15,636 detections
Filters
Last updated
All Time
Detection languages
6,581
4,571
999
788
723
Contributors
3,615
2,087
2,043
1,738
1,271
Categories
9,459
6,773
3,297
2,511
1,598
Platforms
13,080
2,270
1,179
493
256
Products / Services
3,812
3,376
1,976
1,254
704
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
22
21
20
19
19
IDS Classtypes
175
58
53
25
11
IDS Protocols
256
53
17
8
4
Detects hosts exhibiting multiple persistence mechanisms (Run keys, Scheduled Tasks, and Windows Services) within a short timeframe, indicating potential adversary persistence setup.
The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution.
It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators.
While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution.
Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection.
Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay.
It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators.
While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution.
Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection.
Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay.
Detects process creation events where common Office applications (Word, Excel, PowerPoint, Outlook) or archive/reader utilities (Acrobat, WinRAR, 7-Zip) act as the parent process to command-line interpreters, scripting engines, or administrative tools (such as cmd, powershell, wscript, cscript, mshta, rundll32, and others). This behavior is commonly associated with phishing attacks, macro execution, or exploitation of file formats leading to code execution.
Detects the creation of persistence artifacts associated with the 'gh-token-monitor' service utilized by the Shai-Hulud worm across Linux systemd user services, macOS LaunchAgents, and Windows scheduled tasks or local application directories. This service acts as a dead-man's switch designed to wipe the user's home directory if the stolen GitHub token is revoked.
Detects creation or modification of cron entries on the BeyondTrust
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Detects process execution where a shell (such as bash, zsh, cmd, or powershell) is spawned by a skill or openclaw process, and subsequently performs download activities (e.g., using curl, wget, invoke-webrequest) or establishes persistence (e.g., via cron, systemd, registry run keys, schtasks).
Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.
This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg.
These code hosting services can be abused to stage payloads, but administrators and developers also download files from them.
A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.
These code hosting services can be abused to stage payloads, but administrators and developers also download files from them.
A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.
Detects scheduled task creation observed through ADAudit Plus. Scheduled tasks are a
long-standing persistence and remote execution mechanism, and seeing them at the
directory audit layer catches creation across the domain rather than host by host.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='TASK_CREATED'
| groupby user, object, commandline, domain
long-standing persistence and remote execution mechanism, and seeing them at the
directory audit layer catches creation across the domain rather than host by host.
Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS'
and action='TASK_CREATED'
| groupby user, object, commandline, domain
Detects process execution reported by a Smokescreen decoy. A decoy runs no business
workload, so any process beyond the platform's own agent indicates an intruder has
reached the asset and is executing code on it.
Capture the command line in full: on a decoy it is uncontaminated by legitimate
activity and gives a clean view of attacker tooling and intent.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and process != ''
| groupby process, commandline, user, srcip
workload, so any process beyond the platform's own agent indicates an intruder has
reached the asset and is executing code on it.
Capture the command line in full: on a decoy it is uncontaminated by legitimate
activity and gives a clean view of attacker tooling and intent.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and process != ''
| groupby process, commandline, user, srcip
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
Detects suspicious command-line execution patterns involving Unix shells (bash, zsh, sh) spawned from terminal applications where tools like curl or wget are piped directly into a shell, base64 decoding is performed, osascript executes dialogs, or quarantine attributes are removed.
Detects the use of msxsl.exe or wmic.exe to process .xsl or .xslt files, potentially indicating the execution of embedded scripts. The rule calculates a risk score based on the combination of the utility name, the presence of an XSL/XSLT file reference in the command line, usage of suspicious file paths (e.g., Temp, AppData), and being launched by potentially suspicious parent processes like cmd.exe or powershell.exe.
Detects a system shell interpreter being spawned directly by a Celery worker process.
This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context,
which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.
This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context,
which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Detects the use of vim and its siblings commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or breaking out from restricted environments.
Detects msiexec.exe executing an MSI package named update_ms.msi
staged in ProgramData. Chaos ransomware disguises this installer's properties
and filename to impersonate a legitimate Windows Update package. On execution,
a custom action (CA_Run_EA2AEBC3) loads an embedded DLL (Bin_lib_EA2AEBC3,
lib.dll) directly into memory, deploying the msaRAT payload. This rule sees
the installer execution only; the in-memory module load is not observed here
and would need a separate PROCESS_MODULE_LOAD rule.
staged in ProgramData. Chaos ransomware disguises this installer's properties
and filename to impersonate a legitimate Windows Update package. On execution,
a custom action (CA_Run_EA2AEBC3) loads an embedded DLL (Bin_lib_EA2AEBC3,
lib.dll) directly into memory, deploying the msaRAT payload. This rule sees
the installer execution only; the in-memory module load is not observed here
and would need a separate PROCESS_MODULE_LOAD rule.
Detects schtasks.exe creating a scheduled task named "Windows Defender Advanced Threat Protection Service" that launches defender.exe (a renamed Sangfor executable abused for DLL sideloading) with SYSTEM privileges at startup. This is the exact persistence mechanism HoneyMyte (Mustang Panda) uses to relaunch the CoolClient backdoor chain from the fake "Microsoft\Windows Defender" directory on every boot.
Page 10 of 745