Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects command-line execution of script interpreters (PowerShell, CMD, MSHTA) spawned via Windows Explorer containing download primitives and URLs, followed by immediate external network connections.
Detects the sequence where a private key file is written to the host followed by the execution of ssh.exe with parameters indicating a reverse port forwarding tunnel (-R), an identity file (-i), and background execution (-N or -f) within a 30-minute window.
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects the execution of tooling routed through a reverse SOCKS5 pivot via wrappers such as via_socks.sh, proxychains4 with a SOCKS5 configuration, or LD_PRELOAD injection of libproxychains.so.
Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.
Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.
Detects Microsoft Edge (msedge.exe) spawned by command shells or script hosts with hidden or headless window parameters, or communicating with webhook.site, which is commonly indicative of malicious browser automation or exfiltration.
Detects instances where a browser process (Chrome, Edge, Firefox, Brave) is observed on a device shortly before an explorer.exe-initiated PowerShell, PWSH, or CMD process executes a command containing download strings or script execution patterns (such as DownloadString, Invoke-WebRequest, IEX, or encoded commands) referencing URLs.
Detects a sequence where PowerShell downloads an .msi installer file from Azure Blob Storage, followed closely by msiexec.exe spawning a PowerShell process on the same device.
Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects the installation or service setup of unauthorized remote access tools (such as AnyDesk, TeamViewer, or ScreenConnect) followed by outbound public network connections from the same device within a one-hour window.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Detects observable consequences of remote code execution on a GitLab server (CVE-2026-97229), specifically where GitLab application services (such as Puma, Sidekiq, Ruby, GitLab Rails, or GitLab Workhorse) spawn a shell or interpreter with suspicious command-line parameters or external network utilities.
Detects network connections to the npm registry (registry.npmjs.org) initiated by AI coding agent processes (such as Claude, Cursor, Copilot, Windsurf, Codeium, Aider) or by unexpected processes that are not standard package managers or browsers.
Detects DNS requests to major generative AI and Large Language Model API endpoints (such as OpenAI, Anthropic, Google Gemini, Mistral, Groq, DeepSeek, and others) initiated by processes other than standard web browsers (e.g., chrome, msedge, firefox, safari). This behavior may indicate unauthorized data exfiltration, shadow AI usage, or automated tooling/scripts interacting with LLM APIs.
Detects the presence of Tailscale binaries (tailscale.exe, tailscaled.exe) on a device within 24 hours of other campaign-specific toolkit components such as kitanai.exe, nandemo.exe, ufw.exe, or upd-ms.bat, indicating potential unauthorized remote access setup.
Detects potential C2 beaconing activity associated with Potassium by correlating a DNS query for a known C2 domain with a subsequent TCP connection to port 50792 from the same device within a short time window.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.
Detects the execution of known Remote Monitoring and Management (RMM) tools within a 30-minute window following Microsoft Teams network activity on the same device, which can be an indicator of unauthorized remote access or interactive command and control setup via remote support applications.
Page 2 of 297