Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects when a password-protected ZIP archive is opened or extracted on a Windows system. This is identified by EventID 5379 from the Security log, specifically looking for 'Microsoft_Windows_Shell_ZipFolder:filename' in the TargetName field. The rule filters out events originating from '
Temporary Internet Files\Content.Outlook' to reduce false positives.
Temporary Internet Files\Content.Outlook' to reduce false positives.
Detects PowerShell scripts attempting to access the default Windows Mail App mailbox data. This activity could indicate an adversary trying to manipulate, exfiltrate, or delete stored emails. The detection specifically looks for the string '\Comms\Unistore\data' within PowerShell script blocks, which points to the location where the Windows Mail App stores its data.
Detects when a password-protected ZIP archive is opened on a Windows system, specifically looking for archives with suspicious filenames commonly used in phishing or social engineering attacks (e.g., 'invoice', 'order', 'payment'). This rule leverages Windows Security Event ID 5379, which indicates a sensitive privilege use, and filters for events related to the Microsoft_Windows_Shell_ZipFolder:filename provider, combined with a list of suspicious keywords in the TargetName field.
This rule detects PowerShell commands that attempt to discover sensitive files by looking for common file extensions associated with credentials or password managers (e.g., .pass, .kdbx, .kdb). It specifically targets commands like 'ls', 'get-childitem', or 'gci' combined with the '-recurse' parameter, indicating a recursive search for these sensitive file types.
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects System Information Discovery commands
ISO Image Mounted
Sigma
Detects the mount of an ISO image on an endpoint
Detects remote service activity via remote access to the svcctl named pipe
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
Yara rule that detects HotCoffee ransomware.
Yara rule that detects Jormungand ransomware.
Yara rule that detects Zeoticus ransomware.
Yara rule that detects District ransomware.
Page 76 of 76