Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,506
detections

Search detections

Filters

Showing 30 of 11,506

Detect Remote Access Software Usage Traffic

The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.

T1219

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 21, 2026

InformationalSplunk security content

Windows Process Outbound Connection To Social Media Domain

This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. It leverages Sysmon Event ID 3 to surface this anomalous behavior. Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.

T1586.001

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 21, 2026

InformationalSplunk security content

Windows NirSoft Utilities

The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.

T1588.002

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 21, 2026

InformationalSplunk security content

Windows NirSoft Tool Bundle File Created

The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration.

T1588.002

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 21, 2026

InformationalSplunk security content

Detect Remote Access Software Usage FileInfo

The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access.

T1219

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 21, 2026

InformationalSplunk security content

Detect Remote Access Software Usage File

The following analytic detects the writing of files from known remote access software to disk within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on file path, file name, and user information. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.

T1219

Written by: Steven DickAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 21, 2026

MediumSplunk security content

AWS IAM Role Created with External Trust

Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard principal. This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.

T1098.003

Written by: Maria Jose ErquiagaAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

SeDebugPrivilege Enabled by a Suspicious Process

Identifies a process running with a non-SYSTEM account that enables the SeDebugPrivilege privilege. Adversaries may enable this privilege to debug and modify other processes, typically reserved for system-level tasks, to escalate privileges and bypass access controls.

T1134

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

LowElastic detection rules

Suspicious Print Spooler SPL File Created

Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337.

T1068

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

Suspicious Service was Installed in the System

Identifies the creation of a new Windows service with a suspicious service name or command value. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence.

T1543T1543.003T1569T1569.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

Potential Lateral Tool Transfer via SMB Share

Identifies the creation or change of a Windows executable file over network shares. Adversaries may transfer tools or other files between systems in a compromised environment.

T1021T1021.002T1570

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

Suspicious Windows Powershell Arguments

Identifies the execution of PowerShell with suspicious argument values. This behavior is often observed during malware installation leveraging PowerShell.

T1027T1027.010T1059T1059.001T1105+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

LowElastic detection rules

Potential PowerShell Obfuscated Script via High Entropy

Identifies PowerShell script blocks with high entropy and non-uniform character distributions. Attackers may obfuscate PowerShell scripts using encoding, encryption, or compression techniques to evade signature-based detections and hinder manual analysis by security analysts.

T1027T1027.010T1059T1059.001T1140

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

Unusual Network Activity from a Windows System Binary

Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.

T1036T1036.005T1127T1127.001T1218+7 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

Sensitive Audit Policy Sub-Category Disabled

Identifies when a security-sensitive audit policy subcategory is disabled and left disabled. Attackers do this to evade detection and impair forensics.

T1070T1070.001T1562T1562.002T1562.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

First Time Seen Remote Monitoring and Management Tool

Adversaries may install legitimate remote monitoring and management (RMM) tools or remote access software on compromised endpoints for command-and-control (C2), persistence, and execution of native commands. This rule detects when a process is started whose name or code signature matches commonly abused RMM or remote access tools. New Terms type: the host.id and process.name pair has not been seen before within the configured 7-day history window.

T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

LowElastic detection rules

Connection to Commonly Abused Web Services

Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in.

T1071T1071.001T1090T1090.002T1102+8 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

First Seen External MQTT Broker Connection

Identifies the first MQTT relationship from an internal source to an external broker that was not observed during the previous 14 days. This includes protocol-decoded MQTT and direct AWS IoT Core MQTT identified from TLS ClientHello metadata without decryption. MQTT is commonly used by IoT and messaging applications, but malware including BambooToken, IOCONTROL, MQsTTang, and WailingCrab has used publish/subscribe traffic for command and control.

T1071T1071.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

HighElastic detection rules

Suspicious Linux Process Connection to AWS IoT Core MQTT

Identifies a Linux process running from a potentially suspicious location that resolves an account-specific AWS IoT Core data endpoint and then connects over TCP/443 or TCP/8883. Adversaries can use an attacker-controlled AWS IoT Core MQTT broker to relay commands, results, and files without a direct connection from the compromised host to the operator's backend server.

T1071T1071.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumElastic detection rules

M365 Identity Login from Atypical Region

Detects successful Microsoft 365 portal logins from a country and region the user has not previously authenticated from in a specific time window. Atypical regions are identified by combining the user's country and region geolocation history; an authentication from a new country/region pair for that user may indicate an adversary attempting to access the account from an unusual location or behind a VPN.

T1078T1078.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 21, 2026

MediumSigmaHQ

Uncommon Svchost Parent Process

Detects an uncommon svchost parent process

T1036.005

Written by: Florian Roth (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

MediumSigmaHQ

Potential Configuration And Service Reconnaissance Via Reg.EXE

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

T1007T1012

Written by: Timur ZinniatullinAttributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

MediumSigmaHQ

DllUnregisterServer Function Call Via Msiexec.EXE

Detects MsiExec loading a DLL and calling its DllUnregisterServer function

T1218.007

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

HighSigmaHQ

HackTool - GoldenDMSA Execution

Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.

T1098T1110.001T1558.003

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

MediumSigmaHQ

Potentially Suspicious GrantedAccess Flags On LSASS

Detects process access requests to LSASS process with potentially suspicious access flags

T1003.001

Written by: Florian RothAttributed by SigmaHQand 9 more authors
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

MediumSigmaHQ

Powershell Sensitive File Discovery

Detect adversaries enumerate sensitive files

T1083

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

MediumSigmaHQ

Potential In-Memory Execution Using Reflection.Assembly

Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory

T1620

Written by: frack113Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

MediumSigmaHQ

Alternate PowerShell Hosts - PowerShell Module

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

T1059.001

Written by: Roberto Rodriguez @Cyb3rWard0gAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

MediumSigmaHQ

Potentially Suspicious AccessMask Requested From LSASS

Detects process handle on LSASS process with certain access mask

T1003.001

Written by: Roberto RodriguezAttributed by SigmaHQand 5 more authors
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

MediumSigmaHQ

LSASS Access From Non System Account

Detects potential mimikatz-like tools accessing LSASS from non system account

T1003.001

Written by: Roberto Rodriguez @Cyb3rWard0gAttributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 21, 2026

Load more detections

Loading detection rules

Back to results

InformationalSplunk security content Maria Jose Erquiaga +1

Cisco NVM - Browser Spawned Unix Shell with External Connection

Description

Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination. This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems. The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: cisco_network_visibility_module_flow_data

Known benign triggers

Legitimate workflows may launch Unix command interpreters from browser contexts, including developer tooling, software installers, SSO helpers, browser extensions, and automation wrappers. Tuning may be required for approved applications, users, and destinations.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Execution

T1059Command and Scripting Interpreter 599 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
attack.mitre.org/tactics/TA0002/	Taxonomy	8
attack.mitre.org/techniques/T1059/	Taxonomy	7from 2 sources
redcanary.com/threat-detection-report/threats/socgholish/	Security research	3from 2 sources

From the source

At source: Open at source
Upstream identifier: 6f2de8d1-9a2d-4c7a-9b8c-3b8a2f7d0e41
Tagged by the source as: Cisco Network Visibility Module AnalyticsEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Licence

Published under: Apache License 2.0Read the licence
Attribution: Required
Obtained under: Apache-2.0Read the origin licence

Authorship

Written by: Maria Jose Erquiaga
Splunk
Published: Oct 6, 2026
Version: 2