Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,678 detections
Filters
Last updated
All Time
Detection languages
10,194
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,285
2,977
2,238
1,834
1,458
Platforms
10,389
1,109
809
155
98
Products / Services
10,678
9,759
6,693
4,421
3,749
MITRE Techniques
3,818
3,133
1,800
1,572
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects instances of specific legitimate binaries loading known malicious proxy DLLs. This pattern targets the exact sideloading pairs identified in a campaign leveraging a modified Havoc C2 agent.
Detects the execution of the Lua interpreter with a script that has a .ini extension or the known malicious name 'alien.ini' from the Notepad++ supply chain attack. This TTP was used to load and execute shellcode via the Lua Alien FFI library.
Detects the creation of a Windows kernel service using sc.exe where the binary path points to common user-writable or temporary directories. This is a common TTP for Bring Your Own Vulnerable Driver (BYOVD) attacks, often used for privilege escalation and persistence.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
Detects the enumeration of camera or microphone hardware using the 'Get-PnpDevice' PowerShell cmdlet. This behavior is a precursor to surveillance activities such as webcam capture or audio recording and has been associated with the Moonrise RAT.
This rule detects network connections to domains that appear to be dynamically generated IPv6 reverse DNS entries. These types of domains (e.g., 'xxxxxxxxxx.ip6.arpa') are often used in command and control (C2) communications or for exfiltration by malware to evade traditional domain-based detection. The regex specifically looks for a 10-character alphanumeric string followed by '.ip6.arpa'.
Detects a PowerShell command pattern commonly used by the IClickFix framework. This involves using a hidden window to download a script (often .ps1 or .json) and execute it, bypassing the execution policy. This is a common technique following a "ClickFix" social engineering lure.
Detects the Microsoft SharePoint worker process (w3wp.exe) spawning suspicious child processes often used for post-exploitation activity, such as command shells or scripting engines. This behavior is a strong indicator of a webshell execution, as seen in the ToolShell exploitation campaigns.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
This rule detects the connection of external Plug and Play (PnP) devices, including USB storage, to a system. It identifies events where a USB drive is mounted or a generic PnP device is connected, extracting details such as vendor, product ID, and serial number for investigation.
Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.
Detects the creation of the 'UPlugPlay' Windows Service, a known persistence mechanism for the Prometei botnet. The malware may create the service using the command-line tool 'sc.exe' or directly via Windows APIs, which generates Event ID 7045.
Detects instances where a LNK file execution is followed by the launch of a PowerShell process that contains command-line arguments for downloading and/or executing content from the internet. This behavior is the initial execution step in the attack chain detailed in the referenced Fortinet report.
This rule detects when a process, potentially a Go-compiled binary (indicated by 'go' in the command line), establishes persistence by creating or modifying a registry run key or by dropping a file in a startup folder. This behavior is associated with the Moonrise RAT.
Detects persistence via an Internet Shortcut (.url) file in a startup folder that points to a local executable (file://). This is a known TTP of the PHALT#BLYX campaign.
Detects the execution of QEMU where a .dll file is specified as a hard disk image. This is a known TTP associated with the "Bring Your Own Hypervisor" (BYOH) technique, where attackers hide malicious activity within a virtualized environment using non-standard disk image formats.
Detects svchost.exe spawning a shell process (cmd.exe or powershell.exe) where its parent is not the legitimate services.exe. This behavior is a known technique used by Moonrise RAT to proxy commands and evade detection. The rule further scopes to commands targeting temp or public directories, which are common malware staging areas.
Detects NetSupport RAT persistence established via a Registry Run key, followed by the clearing of the RunMRU history. This sequence of events is a known TTP associated with the IClickFix framework, where adversaries attempt to hide the initial execution command after achieving persistence.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
Detects attempts to disable Windows Credential Guard by modifying the 'LsaCfgFlags' registry value. Credential Guard uses virtualization-based security to isolate secrets, and disabling it is a common defense evasion technique used by adversaries to access credentials for lateral movement.
This rule detects activity associated with a developer-targeting campaign leveraging malicious Next.js repositories. It identifies suspicious network connections to known Vercel staging domains and C2 IPs/ports/paths, as well as suspicious process execution patterns involving Node.js or VS Code related processes, and file events related to specific repository artifacts or sensitive file access by developer-adjacent processes. The detection logic covers network communication, process execution, and file system activities indicative of this specific threat.
Page 446 of 509