Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39,970 detections
Filters
Last updated
All Time
Detection languages
15,299
13,596
2,791
1,803
1,720
Contributors
7,678
5,999
5,313
4,504
4,191
Categories
18,073
9,745
3,841
3,747
3,711
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
10,402
9,646
6,669
1,890
1,856
MITRE Techniques
13,733
13,093
8,052
5,935
4,411
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
171
20
16
8
Detects the creation or modification of Windows provisioning packages (.ppkg) by processes other than expected provisioning and servicing tools. Attackers, such as those utilizing the Sirius Backdoor, can abuse custom .ppkg files to maintain persistence across OS resets.
Detects when the Internet Information Services (IIS) worker process (w3wp.exe) spawns suspicious child processes, command interpreters, or reconnaissance utilities, which may indicate web shell activity, remote code execution (RCE) via ViewState deserialization, or other web application exploitation.
Detects behavioral indicators of an SSH or autossh reverse tunnel (-R) executed with no remote command (-N) and host-key checking disabled, combined with network connections to a known command and control IP address.
Detects persistence mechanisms associated with the trojanized anthropic.claude-code loader, including macOS LaunchAgent creation (com.apple.sysmond), Linux cron @reboot persistence using hidden config files (.smt), Windows scheduled tasks (SysMon SYSTEM task), and SSH authorized keys manipulation.
Detects process injection targeting a web browser process.
Amatera and comparable infostealers inject into trusted browser processes
such as Chrome, Edge, Brave and Firefox to evade detection and access
credential and cookie data in memory.
Amatera and comparable infostealers inject into trusted browser processes
such as Chrome, Edge, Brave and Firefox to evade detection and access
credential and cookie data in memory.
Detects a PaperCut server Java process spawning a local account creation or local administrators group addition, followed closely by Active Directory domain or computer enumeration from the same host within a 30-minute window.
Detects access to Chrome or Chromium-based browser Local State files (which contain encrypted keys) by a non-browser process that correlates temporally with a PowerShell process exhibiting ClickFix-style staging characteristics (hidden window, bypass execution policy, and containing a URL).
Detects the execution of Salat Stealer C2-pushed scripts involving the disabling of recovery environment via reagentc.exe and UAC disabling via registry modification on the same device within one hour.
Detects a sequence where PowerShell downloads an .msi installer file from Azure Blob Storage, followed closely by msiexec.exe spawning a PowerShell process on the same device.
Detects processes that make outbound API calls to known Large Language Model (LLM) domains while simultaneously performing high-volume network connection attempts or scanning-like fan-out activity across multiple public IP addresses.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects WinRAR or 7-Zip extracting an archive with a hard-coded password supplied via command line from a cmd.exe batch parent, using switch patterns associated with the RareWolf AnyDesk dropper.
Detects instances where a browser process (Chrome, Edge, Firefox, Brave) is observed on a device shortly before an explorer.exe-initiated PowerShell, PWSH, or CMD process executes a command containing download strings or script execution patterns (such as DownloadString, Invoke-WebRequest, IEX, or encoded commands) referencing URLs.
Detects outbound IPv4 and IPv6 connections from endpoints to public IP addresses on high-numbered ports (1023 and above), excluding private, reserved IP ranges and known noisy processes. Command-and-control tools, malware and tunneling activities may use uncommon ports to evade network monitoring.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Detects the presence of Tailscale binaries (tailscale.exe, tailscaled.exe) on a device within 24 hours of other campaign-specific toolkit components such as kitanai.exe, nandemo.exe, ufw.exe, or upd-ms.bat, indicating potential unauthorized remote access setup.
Detects the creation of cook.pth or cook.py in Python site-packages or dist-packages directories by package managers or interpreters, followed by a Python interpreter execution on the same device within one hour. This pattern matches the malicious supply chain behavior observed in compromised LiteLLM versions (e.g., 1.107.0) utilizing .pth auto-import chains for persistence and execution.
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Detects a suspicious sequence where a client IP performs a brute-force attack against WordPress login or XML-RPC endpoints followed by enumeration of the wp-json REST API.
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Detects Microsoft Edge (msedge.exe) spawned by command shells or script hosts with hidden or headless window parameters, or communicating with webhook.site, which is commonly indicative of malicious browser automation or exfiltration.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Page 6 of 1904