Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15,638 detections
Filters
Last updated
All Time
Detection languages
6,581
4,571
999
788
723
Contributors
3,615
2,087
2,043
1,738
1,271
Categories
9,461
6,774
3,297
2,512
1,599
Platforms
13,082
2,270
1,180
493
256
Products / Services
3,812
3,376
1,976
1,254
704
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
22
21
20
19
19
IDS Classtypes
175
58
53
25
11
IDS Protocols
256
53
17
8
4
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
cURL Request to Raw IP for Installer
Cortex XDR
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This staging pattern is utilized by UNC3753 to deploy RMM payloads on victim machines.
Detects the Intune Management Extension agent spawning command interpreters. Because Intune executes scripts as SYSTEM, monitoring the resulting behavior on the endpoint is critical for identifying malicious script deployments.
Detects process creation where ConfigurationRemotingServer.exe is spawned by winget.exe or WindowsPackageManagerServer.exe. This activity indicates potential WinGet DSC (Desired State Configuration) execution or COM API abuse. Adversaries may leverage WinGet to execute malicious configurations or scripts.
Suspicious Conhost Headless Execution
Cortex XDR
Detects the execution of conhost.exe (or conhost.ext) with the --headless parameter, a technique used in ClickFix campaigns to silently execute clipboard-injected commands.
This rule detects exploitation attempts targeting the Spring4Shell vulnerability (CVE-2022-22965). It specifically looks for HTTP requests containing the string "class.module.classLoader" in the URI, which is a known indicator of this RCE exploitation attempt.
This rule detects potential privilege escalation attempts on UniFi OS systems where the 'ucs-update' service account uses 'sudo' to execute sensitive commands like 'dpkg', 'chmod', or 'systemctl'. This behavior is indicative of the vulnerability described in the Bishop Fox research, where an unauthenticated RCE chain can lead to root escalation.
Cron Job Injection via Web Shell
Suricata
This rule detects attempts to inject cron job commands via web shell activity. It specifically looks for HTTP requests where the URI contains the case-insensitive string "crontab", indicating an attempt to modify scheduled tasks on a system through a web interface, likely a compromised web shell.
Remote AT Job Scheduled via SMB
Suricata
This rule detects attempts to schedule a remote AT job via SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive strings "atsvc" and "JobAdd". This combination indicates an attempt to use the AT service to add a scheduled task remotely, which can be a method for persistence or execution by attackers.
This rule detects the download of a compiled AutoIT script payload over HTTP. It specifically looks for the 'AU3!' magic bytes at the beginning of the file data, which is characteristic of compiled AutoIT executables. The detection is focused on traffic flowing from the server to the client (to_client) and assumes an established connection.
This rule detects potential AWS CLI API command execution by monitoring HTTP traffic for connections to 'amazonaws.com' and the presence of 'Action=' in the URI. It uses a threshold of 30 occurrences within 10 seconds from a single source IP to reduce false positives, indicating a high volume of API calls typical of automated scripts or tools.
This rule detects attempts to access the command-line interface (CLI) of a network device via Telnet, specifically looking for the 'enable' and 'configure terminal' commands. This indicates an administrative attempt to configure or manage a network device.
This rule detects HTTP responses that contain specific keywords indicative of a fake CAPTCHA paste attack page. It looks for the terms "CAPTCHA", "paste", and "Win+R" (case-insensitive) within the HTTP response body. This combination suggests a social engineering attempt where users are tricked into pasting malicious content, often after being instructed to open the 'Run' dialog (Win+R).
This rule detects multiple attempts to pull container image manifests from public Docker registries (registry.hub.docker.com or ghcr.io). A threshold of 10 pulls within 60 seconds from the same source IP is set to identify potentially malicious or excessive activity, possibly indicating an attempt to enumerate or download numerous container images.
This rule detects attempts to establish a TCP connection to port 902 on the home network, which is commonly used for VMware ESXi management. The rule specifically looks for SYN packets (flags:S) and triggers if there are at least 3 such connection attempts from the same source within a 60-second window. This could indicate an attempt to access or scan the ESXi management interface.
This rule detects attempts to deploy a container with host network mode enabled. It specifically looks for HTTP requests to the '/containers/create' endpoint, which is commonly used by container orchestration systems like Docker, and checks for the presence of 'host' within the HTTP client body, indicating the host network mode configuration. This can be a security concern as it allows the container to have direct access to the host's network interfaces, potentially bypassing network segmentation and security controls.
This rule detects attempts to execute commands within a Kubernetes pod using `kubectl exec`. It specifically looks for HTTP requests to port 8080 (often used by Kubernetes API servers or proxies) with URIs containing both '/exec' and 'pods', indicating an interactive command execution session within a pod.
This rule detects executable attachments (e.g., .exe, .bat, .cmd, .scr, .pif, .com) being delivered via SMTP email. It specifically looks for these file extensions within the 'filename' attribute of email attachments.
This rule detects the string "xdotool" within an SSH session (port 22) traffic flowing from the client to the server. xdotool is a command-line tool that simulates keyboard input and mouse activity, often used for automated input injection. Detection of this string suggests an attempt to automate actions within an SSH session, which could be indicative of malicious activity such as automated command execution or data exfiltration.
Page 472 of 745