Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the creation of 'format-results.txt' on a system, which is used by the malicious GitHub Actions workflow injected by the Checkmarx worm to store serialized GitHub repository secrets.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
This rule detects multiple TTPs (Tactics, Techniques, and Procedures) associated with advanced adversaries, including QEMU virtualization abuse for defense evasion, creation of malicious scheduled tasks (specifically 'TPMProfiler'), rogue account or service creation (e.g., 'CtxAppVCOMService' or 'AppMgmt' service via 'sc.exe'), port forwarding/tunneling commands (using 'ssh' or 'portproxy' with specific ports), credential access attempts via 'vssuirun.exe' or printing 'NTDS.dit', and potential DLL sideloading involving 'ADNotificationManager.exe' and 'vcruntime140_1.dll'. It also includes IOCs for specific IPs, domains, and file hashes.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631
This query searches for multiple indicators associated with the STAC4713 and STAC3725 campaigns (often linked to PayoutsKing/GOLD ENCOUNTER). It utilizes a fast free-text pre-filter followed by a case statement to categorize specific TTPs, including QEMU abuse, rogue scheduled tasks, suspicious services/accounts, covert tunneling, and credential access.
This rule detects attempts to modify the SSH authorized_keys file, which can be used by adversaries to maintain persistence on a compromised system, using common utilities like echo, tee, cp, mv, python, or perl.
Detects the execution of the 'ChromeElevator' component, which is explicitly staged and utilized by the CrystalX RAT to extract and harvest credentials from Chromium-based web browsers.
Detects HTTP POST requests to specific URI paths (res.php, tele.php) commonly associated with BlobPhish credential exfiltration. This rule identifies attempts to send stolen credentials or other sensitive data to attacker-controlled endpoints.
Detects suspicious processes attempting to access Microsoft Teams local storage or cookies via command line parameters, a technique commonly used by info-stealers. The rule specifically looks for command line arguments targeting 'Cookies' or 'Local Storage\leveldb' paths within the Microsoft Teams directory, while excluding legitimate Teams executables to reduce false positives.
Detects successful sign-ins using the axios/1.7.9 user agent. Storm-2755 uses this to replay stolen session tokens and maintain persistence via automated sign-ins approximately every 30 minutes. The rule filters for successful authentications and requires at least two authentications from the same user, IP, and user agent within the time window to identify the repeated automated persistence loop.
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.
Show when private keys are being exported from the device, or when new certificates are installed
Multi-layered detection for two linked March 2026 threat campaigns identified by ANY.RUN and Objective-See:
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
**Campaign 1 — EvilTokens (OAuth Device Code Phishing)**
Abuses Microsoft's OAuth 2.0 Device Code authentication flow to silently hijack enterprise accounts. Attackers trick users into entering a device code on Microsoft's legitimate login page, granting the attacker a valid OAuth token — no credentials stolen, no MFA bypass needed. Over 180 phishing URLs detected in a single week. Targets: Technology, Education, Manufacturing, and Government sectors (US & India focus).
**Campaign 2 — AMOS Stealer (macOS ClickFix)**
Distributed via a trojanized disk image (Clearl_AI.dmg) posing as an AI tool installer. Harvests browser credentials, macOS Keychain, cryptocurrency wallets (256 extensions), Apple Notes, and sensitive files. Deploys a persistent backdoor via ~/.mainhelper (WebSocket reverse shell) and LaunchAgent persistence (com.apple.mdworker.plist / com.apple.systemupdate). Kills security tools (Little Snitch, BlockBlock, Lulu) and validates stolen passwords against the keychain.
1. EvilTokens — Detects Device Code OAuth sign-ins from suspicious infrastructure (workers[.]dev phishing domains)
2. AMOS IOC Network Sweep — Identifies connections to known C2/payload domains (laislivon.com, rvdownloads.com)
3. AMOS Behavioral — Detects ClickFix-style base64 curl-to-shell execution, /tmp/helper payloads, and LaunchAgent persistence artifacts
4. Cross-platform IOC file hash matching across endpoints
Detects rapid password change (Event ID 4724) or attempt (Event ID 4723) events on local administrator accounts within a short timeframe. This behavior is indicative of the BlueHammer zero-day local privilege escalation (LPE), where an attacker temporarily overwrites a local admin's password to spawn a SYSTEM shell and immediately restores the original hash to evade detection.
Detects attempts to read raw disk data using mknod or dd, a technique observed in malicious npm packages to bypass permissions and extract secrets.
Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.
Detects S3 Browser utility creating IAM User or AccessKey.
Detects DCShadow via create new SPN
Page 151 of 206