Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects the sequence where a private key file is written to the host followed by the execution of ssh.exe with parameters indicating a reverse port forwarding tunnel (-R), an identity file (-i), and background execution (-N or -f) within a 30-minute window.
Detects PowerShell processes combining local loopback listener terms (such as HttpListener or TcpListener) and authentication or web request cmdlets referencing 127.0.0.1 or localhost, correlated with local network loopback connections.
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects instances where an AOMEI-related process initiates an outbound WebDAV-style connection to a public host, followed closely by a Windows WebClient service (svchost.exe) connection to the same remote IP address.
The detection targets these behaviours:
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Detects PaperCut server processes (such as pc-app.exe, pc-server.exe, or Java running PaperCut) spawning command shells or utility binaries associated with credential dumping, internal reconnaissance, or pivoting.
Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects the execution of OpenConnect VPN clients on non-sanctioned devices followed within a 4-hour window by high-volume internal network connections across multiple ports indicative of network service discovery or pivoting activity.
Detects a PaperCut server Java process spawning a local account creation or local administrators group addition, followed closely by Active Directory domain or computer enumeration from the same host within a 30-minute window.
Detects DeElevate64.exe within the Stardock Smart DeElevation Tool directory loading I++u.dll, a known malicious loader dependency associated with patched DeElevator64.dll usage.
Detects access to Chrome or Chromium-based browser Local State files (which contain encrypted keys) by a non-browser process that correlates temporally with a PowerShell process exhibiting ClickFix-style staging characteristics (hidden window, bypass execution policy, and containing a URL).
Detects the execution of Salat Stealer C2-pushed scripts involving the disabling of recovery environment via reagentc.exe and UAC disabling via registry modification on the same device within one hour.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Detects Microsoft Edge (msedge.exe) spawned by command shells or script hosts with hidden or headless window parameters, or communicating with webhook.site, which is commonly indicative of malicious browser automation or exfiltration.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects instances where a browser process (Chrome, Edge, Firefox, Brave) is observed on a device shortly before an explorer.exe-initiated PowerShell, PWSH, or CMD process executes a command containing download strings or script execution patterns (such as DownloadString, Invoke-WebRequest, IEX, or encoded commands) referencing URLs.
Page 3 of 509