Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects svchost.exe spawning a shell process (cmd.exe or powershell.exe) where its parent is not the legitimate services.exe. This behavior is a known technique used by Moonrise RAT to proxy commands and evade detection. The rule further scopes to commands targeting temp or public directories, which are common malware staging areas.
Detects NetSupport RAT persistence established via a Registry Run key, followed by the clearing of the RunMRU history. This sequence of events is a known TTP associated with the IClickFix framework, where adversaries attempt to hide the initial execution command after achieving persistence.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
Detects attempts to disable Windows Credential Guard by modifying the 'LsaCfgFlags' registry value. Credential Guard uses virtualization-based security to isolate secrets, and disabling it is a common defense evasion technique used by adversaries to access credentials for lateral movement.
This rule detects activity associated with a developer-targeting campaign leveraging malicious Next.js repositories. It identifies suspicious network connections to known Vercel staging domains and C2 IPs/ports/paths, as well as suspicious process execution patterns involving Node.js or VS Code related processes, and file events related to specific repository artifacts or sensitive file access by developer-adjacent processes. The detection logic covers network communication, process execution, and file system activities indicative of this specific threat.
Detects network traffic to a known StegaBin C2 IP address or specific URI paths used for data exfiltration. This activity is associated with multiple modules of the StegaBin infostealer toolkit.
Detects the loading of specific vulnerable drivers ('zam64.sys', 'UpdateCheckerX64.sys') used by ransomware groups like CrazyHunter and Interlock to terminate security products. The query combines multiple data sources to detect different stages of BYOVD activity, including driver file creation, registry entries for service creation, and command-line activity related to driver loading.
Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.
Detects non-browser processes making DNS-over-HTTPS (DoH) queries to Cloudflare's DNS service. This specific behavior is used by the Dohdoor backdoor to resolve its C2 domains while evading traditional DNS monitoring. The rule specifically looks for connections to Cloudflare's DoH service (1.1.1.1 or cloudflare-dns.com on port 443 with the /dns-query path) from processes that are not common web browsers. The fidelity is significantly increased by the optional check for the 'insomnia' User-Agent, which is characteristic of the Dohdoor malware.
This rule detects files by their SHA256 hash that are known to be associated with the exploitation of CVE-2026-1731. This includes payloads such as SparkRAT, VShell, and various web shells and droppers.
Detects instances where a development environment like VS Code or Cursor spawns a shell process that then uses a download utility to fetch and execute remote content. This is a known TTP for the 'Contagious Interview' campaign which abuses IDE task auto-execution features.
This rule detects suspicious activity related to WebView2 processes interacting with AI webchat domains, potentially indicating covert command and control (C2) proxying or other malicious use. It looks for WebView2 traffic to specific AI domains (Grok, Copilot) originating from unusual parent processes, WebView2 access to Grok with URL parameter-driven prompt execution, and suspicious child process execution (cmd.exe, powershell.exe, calc.exe) where WebView2 is the parent process.
Detects the use of the living-off-the-land binary (LOLBIN) extrac32.exe to decompress cabinet (.cab) or .vstm files from user-writable locations. This technique is used by loaders like CastleLoader to unpack malicious stages.
Detects when the Windows Service Control Manager (services.exe) spawns a suspicious child process. This can indicate an attacker has configured a service's recovery options to execute a malicious command or script upon service failure.
Detects network connections to domains and URLs known to be used by the 'Contagious Interview' campaign for staging malicious batch scripts and PyArmor payloads. This rule specifically looks for connections to hardcoded malicious domains and URL paths identified with the campaign.
This rule detects various indicators associated with a developer-targeting campaign, including Node.js fetching remote JavaScript from untrusted PaaS domains, dynamic loader behavior in next.config.js, repeated beaconing to C2 paths, detached child Node interpreters, directory enumeration and exfiltration behavior, and suspicious access to sensitive files on developer machines.
Detects modifications to the registry values responsible for service recovery actions, specifically the 'FailureCommand' or 'FailureActions' values. This can indicate an attacker is configuring a service to execute a malicious payload upon failure for persistence or privilege escalation.
This query identifies devices that have specific software installed, enriching this information with device details like OS, exposure level, and internet-facing status. This is useful for asset inventory and identifying potentially exposed endpoints, especially when vulnerability information might not be immediately available through other means. The current rule is configured to detect "Acronis Cyber Protect" software.
Detects non-browser processes making outbound connections to specific Google Sheets API endpoints used by the GRIDTIDE backdoor for command and control. This activity is indicative of the malware using legitimate cloud services to disguise its C2 traffic.
Detects the execution of legitimate Windows binaries with command-line arguments containing URL patterns. This is a technique used by the Dohdoor malware campaign to pass C2 information to a sideloaded malicious DLL.
This rule detects PowerShell commands used to encode data (like hostnames) into hexadecimal strings and exfiltrate it via DNS queries to known Out-of-Band Application Security Testing (OAST) domains. This technique is used by attackers to bypass egress filtering and confirm system compromise, as seen in the exploitation of CVE-2026-1731.
Page 447 of 509