Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39,970 detections
Filters
Last updated
All Time
Detection languages
15,299
13,596
2,791
1,803
1,720
Contributors
7,678
5,999
5,313
4,504
4,191
Categories
18,073
9,745
3,841
3,747
3,711
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
10,402
9,646
6,669
1,890
1,856
MITRE Techniques
13,733
13,093
8,052
5,935
4,411
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
171
20
16
8
Detects ABNotify.exe, running from the standard AOMEI Backupper installation path,
spawning any executable located in the html\ rendering hierarchy. This directory is
intended for rendering assets, not executables; a child process launched from here
indicates a hijacked upgrade workflow triggered through the AOMEI notification agent
with no user interaction.
spawning any executable located in the html\ rendering hierarchy. This directory is
intended for rendering assets, not executables; a child process launched from here
indicates a hijacked upgrade workflow triggered through the AOMEI notification agent
with no user interaction.
Detects cmd.exe launched from the Windows Run dialog (explorer.exe
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects backup service processes writing server-side scripts into web-accessible directories, indicating potential web shell deployment after application compromise.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects the setting of the TS_SERVE_ALLOW_ALL_INTERFACES environment variable or registry key combined with the execution of Tailscale serve or funnel commands on the same device within a 24-hour window, potentially indicating unauthorized exposure of local services.
Detects Trays.exe started with the -tray argument from a Trays subfolder or a batch script, as observed in the RareWolf BAT dropper ahead of a silent AnyDesk installation.
Detects the archiving of the ProgramData AnyDesk directory using WinRAR/RAR with header encryption or the PowerShell Compress-Archive function, which indicates configuration staging for potential exfiltration.
Detects potential C2Agent parent-spoofing behavior characterized by short-lived scheduled tasks (created and deleted within a 10-minute window with names matching c2a_<n>) or process relaunches carrying specific -fork2 command-line markers.
Detects credential harvesting tooling and activity targeting PaperCut configuration and log files by identifying specific parser script executions, searches for PaperCut credential key patterns in process command lines, and the creation of related harvest artifacts.
Detects PowerShell using System.Net.WebClient DownloadFile or related commands to fetch tool dependencies (such as 7z, MSTSCLib, ffmpeg) from GitHub repositories associated with the 'websalat' naming convention, indicative of Salat Stealer or similar tool-loading activity.
Detects the execution of administrative commands and scripting interpreters spawned by the VMware Tools daemon (vmtoolsd), which may indicate an adversary leveraging ESXi guest operations for remote code execution.
Detects the execution of the public Horizon3.ai PoC exploit for CVE-2026-106173 (FortiSIEM gRPC path traversal RCE) utilizing python interpreters with specific command-line arguments indicative of the exploit tool.
Detects the creation of AI coding assistant configuration files (such as .cursorrules, CLAUDE.md) in user directories (Downloads, Desktop, Temp) by non-git processes, followed within a short time window by execution of interpreters or tools (like node, npm, powershell, cmd, curl) with suspicious command line parameters indicating possible download or script execution.
Detects HTTP requests containing serialized PHP objects in the Cookie header matching patterns associated with Zend Framework or Laminas gadget chains, characteristic of PHP object deserialization exploitation (e.g., PHPGGC style).
Detects execution and network activity associated with the cache_base operator toolkit, including JuicyPotatoNG (kitanai.exe), RegPwn (nandemo.exe), ufw.exe reverse shell, and upd-ms.bat launching these tools with connections to *.strangled.net on port 7070.
Detects sandbox or training hosts performing DNS resolution followed shortly by outbound connections to public IP addresses on ports 80 or 443, which may indicate a firewall misconfiguration or unauthorized egress from isolated environments.
Detects observable hiding actions targeting ScreenConnect (ConnectWise Control) clients, such as modifying registry keys to hide uninstall entries, using attrib.exe to set hidden attributes, or launching management tools with hidden window styles.
Detects script execution (such as wscript, cscript, mshta) spawned from a shell parent process (like explorer.exe or cmd.exe) referencing browser cache files (matching f_* in browser profile directories) or copying scripts to the local Temp directory as t.vbs.
Detects potential DLL sideloading of mscoree.dll outside of standard system and .NET paths, followed closely by network activity connecting to GitHub from the same process within a one-hour window.
Page 10 of 1904