Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39,970 detections
Filters
Last updated
All Time
Detection languages
15,299
13,596
2,791
1,803
1,720
Contributors
7,678
5,999
5,313
4,504
4,191
Categories
18,073
9,745
3,841
3,747
3,711
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
10,402
9,646
6,669
1,890
1,856
MITRE Techniques
13,733
13,093
8,052
5,935
4,411
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
171
20
16
8
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects PowerShell attempting to install and start the OpenSSH Server on Windows, typically triggered by malicious extensions or backdoors to enable remote SSH access.
Detects the correlation of a file creation event in the user Temp folder (such as t.vbs) originating from browser cache or download patterns, followed shortly by the execution of the script via wscript.exe or cscript.exe.
Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.
Detects cmd.exe launching curl.exe with TLS verification disabled, redirect following, an output file, and forced hostname-to-IP resolution, or the PowerShell Invoke-WebRequest with a certificate-check bypass switch, often associated with malicious trojan droppers.
Detects password spraying behavior (many accounts targeted with few failures each from the same source IP within a 1-hour window) preceded or accompanied by directory enumeration activity such as SAM-R queries, account enumeration, or LDAP queries from the same source.
Detects AnyDesk being silently installed with the --install and --silent flags or having an unattended-access password configured via the --set-password and _unattended_access parameters, typically piped via stdin from a batch dropper using cmd.exe.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
Detects execution of a specific PowerShell remediation script using execution policy bypass, or generic PowerShell activity importing certificates into the LocalMachine\Disallowed store outside of known administrator processes and accounts.
Detects a file creation event for any executable inside the "tmphtml" staging
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
Detects a file creation event for any executable inside the "tmphtml" staging
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
directory beneath the AOMEI Backupper installation path, where the creating process
is Backupper.exe. The application stages popup resources here before relocating them
to html\; a genuine promotional bundle contains no executables, so an .exe written
to this path indicates a tampered bundle.
Detects behavior where PowerShell or pwsh executes msiexec.exe to silently install an MSI file located in a temporary directory with a GUID-prefixed filename, optionally following a recent download from a remote URL.
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Detects attempts to download the cache_base file using various command-line utilities (wget, curl, node fetch) on a single device, correlating multiple download methods within a 10-minute window or matching known malicious mirror IOCs.
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Detects the execution of the rclone.exe utility with copy, sync, move, or copyto command-line arguments, correlated with outbound network connections to Wasabi S3 or MEGA cloud storage domains.
Detects process command lines containing Magento database audit strings (cms_block, cms_page) alongside specific loader domains, or network events communicating with these known loader domains.
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects Salat Stealer dropping and executing copies of Lightshot.exe in trusted directories such as Windows NT, Edge, and Chrome application paths, as well as process spawn chains involving masqueraded Lightshot executables.
This rule aggregates software inventory, vulnerability assessments, network connection events, and exposure graph data to prioritize patching and identify internet-facing devices running PHP with known vulnerabilities or active web listeners.
Detects inbound network connections from known IP addresses associated with PHP2Shell exploitation attempts and malicious tooling infrastructure.
Page 4 of 1904