Browse detections

Search across every tracked source. Filter by severity, format, or ATT&CK technique.

Reset

60793 matches · 19112 atomic-IOC hidden · show · 1802 non-detections hidden · show · 11700 deprecated hidden · include

Detection Source Severity ATT&CK Updated ↓
Application Javascript Injection via Nodejs elastic/protections-artifacts Undefined T1195 T1195.001 +2 2026-10-09
Arbitrary Python Code Execution via Nodejs elastic/protections-artifacts Undefined T1059 T1059.006 2026-10-09
AWS S3 Object Copied to External Account Bucket panther-labs/panther-analysis Medium T1537 T1486 2026-10-09
AWS S3 Object Exfiltration WITH Object Deletion panther-labs/panther-analysis High T1537 T1486 2026-10-09
Cloud Credential Files Accessed by Process in Suspicious Directory elastic/protections-artifacts Undefined T1552 T1552.001 2026-10-09
Connection to WebService by an Unsigned Binary elastic/protections-artifacts Undefined T1071 T1071.004 +1 2026-10-09
Connection to WebService by a Signed Binary Proxy elastic/protections-artifacts Undefined T1218 T1071 +2 2026-10-09
Creation of Hidden Shared Object File elastic/protections-artifacts Undefined T1129 T1564 +1 2026-10-09
Decoded or Decrypted Payload Written to Suspicious Directory elastic/protections-artifacts Undefined T1059 T1059.004 +4 2026-10-09
DNS Request by Recently Created Executable elastic/protections-artifacts Undefined T1204 T1204.002 +3 2026-10-09
Download of ScreenConnect RMM Installer from Suspicious URL elastic/protections-artifacts Undefined T1105 T1219 2026-10-09
Dual Persistence via Startup and Scheduled Task elastic/protections-artifacts Undefined T1053 T1053.005 +3 2026-10-09
ET HUNTING Generic RPC Endpoint with Auth Header Command Injection Attempt Emerging Threats Open High T1190 2026-10-09
Hidden Payload Executed via Scheduled Job elastic/protections-artifacts Undefined T1053 T1053.003 +2 2026-10-09
Indirect Command Execution via Console Window Host elastic/protections-artifacts Undefined T1202 2026-10-09
Ingress Tool Transfer via CURL elastic/protections-artifacts Undefined T1105 2026-10-09
Initial Access or Execution via Microsoft Office Application elastic/protections-artifacts Undefined T1566 T1566.001 +11 2026-10-09
Jscript Execution Using Cscript App splunk/security_content Undefined T1059.007 2026-10-09
Long Base64 Command Execution via Interactive Shell elastic/protections-artifacts Undefined T1059 T1059.001 +6 2026-10-09
Non-interactive Shell Upgrade elastic/protections-artifacts Undefined T1059 T1059.004 2026-10-09
Ping Sleep Batch Command splunk/security_content Undefined T1497.003 2026-10-09
Possible Lateral Movement PowerShell Spawn splunk/security_content Undefined T1021.003 T1021.006 +5 2026-10-09
Potential CVE-2024-21338 Exploitation elastic/protections-artifacts Undefined T1068 T1562 2026-10-09
Potential Library Load via ROP Gadgets elastic/protections-artifacts Undefined T1055 2026-10-09
Potential LSASS Credential Dumping via KslD Driver elastic/protections-artifacts Undefined T1211 T1003 +1 2026-10-09
Potential Remote Code Execution via URL Encoded Payload elastic/protections-artifacts Undefined T1059 T1059.004 +5 2026-10-09
Potential Reverse Shell Activity via TCP/UDP Socket elastic/protections-artifacts Undefined T1059 T1059.004 +1 2026-10-09
Potential Reverse Shell Activity via Terminal elastic/protections-artifacts Undefined T1059 T1071 2026-10-09
Potential SUID/SGID Files Enumeration elastic/protections-artifacts Undefined T1548 T1548.001 +1 2026-10-09
Shell Command Piped to Osascript via Shell Script elastic/protections-artifacts Undefined T1059 T1059.002 +1 2026-10-09
Socat Reverse Shell or Listener Activity elastic/protections-artifacts Undefined T1059 T1059.004 +1 2026-10-09
Suspicious Echo Execution elastic/protections-artifacts Undefined T1053 T1053.003 +8 2026-10-09
Suspicious Enumeration via LDAP Search elastic/protections-artifacts Undefined T1069 T1069.002 +3 2026-10-09
Suspicious Execution via Windows Management Instrumentation elastic/protections-artifacts Undefined T1047 2026-10-09
Suspicious File Downloaded by Curl/Wget and Piped to Interpreter elastic/protections-artifacts Undefined T1059 T1059.004 +1 2026-10-09
Suspicious Powershell Child Process elastic/protections-artifacts Undefined T1059 T1059.001 2026-10-09
Suspicious PowerShell Execution elastic/protections-artifacts Undefined T1059 T1059.001 2026-10-09
Suspicious Remote Javascript Evaluation via Nodejs elastic/protections-artifacts Undefined T1059 T1059.007 2026-10-09
Suspicious Ruby Command Execution elastic/protections-artifacts Undefined T1059 2026-10-09
Suspicious String Value Written to Registry Run Key elastic/protections-artifacts Undefined T1547 T1547.001 2026-10-09
Suspicious Unload of Elastic Agent via Launchctl elastic/protections-artifacts Undefined T1562 T1562.001 2026-10-09
Svchost LOLBAS Execution Process Spawn splunk/security_content Undefined T1053.005 2026-10-09
System Reconnaissance from Unsigned Parent Followed by Network Connection elastic/protections-artifacts Undefined T1082 T1071 +1 2026-10-09
Unsigned or Untrusted Binary Execution via XPC call elastic/protections-artifacts Undefined T1059 T1059.004 +2 2026-10-09
Untrusted or Unsigned binary Execution via Osascript elastic/protections-artifacts Undefined T1059 T1059.002 2026-10-09
Unusual Command Execution via Cron elastic/protections-artifacts Undefined T1059 T1059.004 +4 2026-10-09
Unusual Command Execution via Systemd Scheduled Task elastic/protections-artifacts Undefined T1059 T1059.004 +4 2026-10-09
Vbscript Execution Using Wscript App splunk/security_content Undefined T1059.005 2026-10-09
VirtualProtect API via Stack Truncation elastic/protections-artifacts Undefined T1055 2026-10-09
Windows Command Shell DCRat ForkBomb Payload splunk/security_content Undefined T1059.003 2026-10-09

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.