Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39,273 detections
Filters
Last updated
All Time
Detection languages
15,001
13,546
2,525
1,803
1,722
Contributors
7,678
6,007
5,306
4,504
4,035
Categories
17,767
9,473
3,749
3,682
3,674
Platforms
39,273
6,902
6,444
3,782
3,524
Products / Services
10,164
9,427
6,496
1,858
1,707
MITRE Techniques
13,653
12,961
7,909
5,844
4,367
CVEs
50
45
30
30
29
IDS Classtypes
214
56
40
24
19
IDS Protocols
181
171
20
17
8
Detects git checkout of a bare 40-hex commit SHA or the literal FETCH_HEAD ref, executed by a recognized AI coding-agent process. Narrowed to the Plugin4Shell exploitation fingerprint (checkout of a pinned-SHA-shaped or FETCH_HEAD ref) rather than ordinary branch/tag checkouts, which these agents perform constantly during normal plugin installs.
Detects git checkout of a bare 40-hex commit SHA or the literal FETCH_HEAD ref, executed by a recognized AI coding-agent process. Narrowed to the Plugin4Shell exploitation fingerprint (checkout of a pinned-SHA-shaped or FETCH_HEAD ref) rather than ordinary branch/tag checkouts, which these agents perform constantly during normal plugin installs.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects git checkout of a bare 40-hex commit SHA or the literal FETCH_HEAD ref, executed by a recognized AI coding-agent process. Narrowed to the Plugin4Shell exploitation fingerprint (checkout of a pinned-SHA-shaped or FETCH_HEAD ref) rather than ordinary branch/tag checkouts, which these agents perform constantly during normal plugin installs.
Detects evidence of potential credential dumping from the Local Security Authority Subsystem Service (LSASS) process. The rule monitors for two distinct behaviors: the use of MemProcFS with device memory access flags targeting a RAW file, and the creation of files containing 'lsass.exe', 'minidump', and 'readme.txt' in their paths or filenames, which is characteristic of certain post-exploitation toolkits that harvest LSASS memory.
Detects the execution of PowerShell commands that reference the 'nyx' script from 'raw.githubusercontent.com', combined with common download and execution patterns such as 'Invoke-Expression' or 'Invoke-WebRequest'. This activity is consistent with retrieving and executing remote post-exploitation scripts.
Detects the execution of Python scripts named 'exploit.py' or 'exp.py', which are common naming conventions associated with proof-of-concept or exploit code.
Detects execution and file artifacts associated with the 'fscan' network scanning tool, which is commonly used for internal network discovery and vulnerability scanning. The rule monitors for the presence of the fscan binary or evidence of its output files, specifically 'result.txt', often in combination with scanning parameters like port strings or target service references.
Detects the execution of PrintSpoofer or its derivatives, often used to perform privilege escalation on Windows systems by abusing the Print Spooler service. The rule also covers the download of the tool via PowerShell.
Detects the execution of 1C:Enterprise business automation software processes (1cv8.exe, 1cv8c.exe, rphost.exe) using specific suspicious external processing files (epf) such as 'Obrabotka_bez_svedeniy.epf' or 'ExternalProcessing1'. This includes detection of the file creation event to identify potential persistence or execution of malicious automation scripts within the 1C environment.
This rule detects potential unauthorized activity originating from 1C Enterprise processes (rphost.exe, rmngr.exe, 1cv8.exe, 1cv8c.exe) when involving specific keywords like '1C-Shell.dt' or 'KRAUD'. It specifically monitors for the subsequent execution of local user account management commands (net user, net localgroup, New-LocalUser) by the 1C server process (rphost.exe) within an hour of the initial suspicious event.
This rule detects potentially suspicious activity involving the 1C Enterprise software suite. It monitors for the execution of 'rmngr.exe' with debug flags or the spawning of processes by 'rphost.exe' that involve suspicious command files named with a 'v8_5fed' prefix located in temporary directories, which is indicative of potential exploitation attempts or unauthorized script execution within the application environment.
Detects the use of sc.exe or cplsupport.exe with command-line arguments often associated with service installation, configuration, or modification. This behavior may indicate an adversary attempting to establish persistence or escalate privileges by creating or modifying Windows services.
Detects HTML files utilizing the 'GhostCode' technique to hide malicious phishing redirects. The technique involves a password-protected HTML lure that uses JavaScript (Web Crypto API) to derive an AES-256-GCM key from a user-provided password via PBKDF2, decrypt an embedded ciphertext payload, and dynamically redirect the user to a concealed phishing URL.
Detects the presence and execution of components related to the 'GhostCode' activity, specifically the installation of a rogue self-signed root certificate authority (CA) masquerading as Google Trust Services and the subsequent configuration of a local TLS-intercepting proxy. The detection monitors for the creation of specific archive files, modification of the system certificate store, addition of local firewall rules, and modification of the local hosts file.
Detects infostealer malware (e.g., Vidar, Lumma, RedLine) that specifically searches for Claude/Anthropic session cookies, API tokens, and generic browser-based credential storage artifacts.
Detects evidence of ONYXC2 malware activity by correlating process-related events (mutex creation, remote thread injection, named pipes) with suspicious registry key or value modifications containing the 'ONYXC2' indicator within a 5-minute window.
This rule detects when a DLL containing 'python' in its filename is loaded by a process that is not an identified Python interpreter or the dropbox.exe application. The rule specifically filters for these DLLs being larger than 10MB, which may indicate the use of embedded Python environments to facilitate malicious code execution or side-loading.
Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.
Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.
Detects a specific adversarial pattern used to bypass authentication protections, where a browser process first navigates to an attacker-controlled identity verification or CAPTCHA challenge page, followed by an immediate navigation to legitimate Microsoft device code authentication endpoints within the same process session.
Page 268 of 1871