Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15,636 detections
Filters
Last updated
All Time
Detection languages
6,581
4,571
999
788
723
Contributors
3,615
2,087
2,043
1,738
1,271
Categories
9,459
6,773
3,297
2,511
1,598
Platforms
13,080
2,270
1,179
493
256
Products / Services
3,812
3,376
1,976
1,254
704
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
22
21
20
19
19
IDS Classtypes
175
58
53
25
11
IDS Protocols
256
53
17
8
4
Detects instances where a browser process (Chrome, Edge, Firefox, Brave) is observed on a device shortly before an explorer.exe-initiated PowerShell, PWSH, or CMD process executes a command containing download strings or script execution patterns (such as DownloadString, Invoke-WebRequest, IEX, or encoded commands) referencing URLs.
Detects node.exe or npm spawning command shells or Living-off-the-Land Binaries (LOLBins) as part of npm preinstall or postinstall lifecycle scripts.
Detects the deployment of the ARTEX AI penetration testing framework via Docker/Docker-compose combined with the execution of offensive security and scanning tools (such as nmap, sqlmap, nuclei, httpx, apktool, frida) on the same host within a specified timeframe.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects the execution of the ROMULUS staging script via PowerShell script block logging (Event ID 4104). The rule identifies specific indicators including the use of environment variable '__ST', '$MyInvocation.MyCommand.Path', dynamic code reconstruction via '[scriptblock]::Create', and a high comma count exceeding 200.
Detects PowerShell execution spawning 7zr.exe to extract password-protected 7z archives using overwrite and password switches within a specified timeframe, or referencing specific malicious IOC file names and domains.
Detects the correlation of Registry Run key values for known utilities (Lightshot, Procmon, RuntimeBroker) pointing to paths in Program Files with a scheduled task creation of the same name on the same device within a 1-hour window.
Detects a sequence where PowerShell downloads an .msi installer file from Azure Blob Storage, followed closely by msiexec.exe spawning a PowerShell process on the same device.
Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Detects PowerShell registering a logon scheduled task that executes a Trays.exe binary from an AppData Yandex Trays path with the -tray argument, or a scheduled task specifically named 'Microsoft apdate'. Associated with the RareWolf AnyDesk dropper batch script.
Detects endpoint network connections and correlates multi-stage communications associated with the ClickFix browser cache smuggling campaign, including initial payload retrieval and secondary stage/C2 communication across devices.
Detects suspicious Ghostscript execution patterns where Python spawns Ghostscript with dangerous I/O pipe arguments or disabled SAFER mode, or where Ghostscript spawns shell interpreters.
Detects indicators of compromise including Bash-based reverse shells communicating with a C2 domain on port 7070, outbound network connections from web server and shell processes to the same C2 infrastructure, and the dropping of known suspicious plugin archive files (akismetv4-plugin.zip, Hlx.zip, template.zip).
Detects when a shell process (such as sh, bash, dash, cmd.exe, or powershell.exe) is spawned by a metrics, logging, or authentication management service shortly after the service accepts an inbound network connection, potentially approximating exploitation of an internal management service.
Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.
Detects the execution of fsquirt.exe spawned by INISAFECrossWebEXSvc.exe where fsquirt.exe subsequently loads an unsigned or untrusted DLL, indicative of a potential TechHub DLL side-loading technique.
Page 3 of 745