Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,459
11,842
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Detects unauthorized access, creation, modification, or deletion of the 'passkey_enclave_state' file within the Google Chrome user data directory by processes other than 'chrome.exe'. This file contains sensitive cryptographic material related to Chrome's synced passkey cloud authenticator, and non-browser process interaction with it is indicative of potential credential theft or passkey exfiltration (e.g., 'Golden/Silver Pass-ta-key' attacks).
Detects the use of the Certutil utility to decode an encoded file (often obfuscated malicious code) followed by the execution of an MSI installer on the same device. This pattern is commonly used in multi-stage downloaders and installer-based attacks to reassemble or deobfuscate payload files.
Detects non-git processes such as VS Code, VS Code Server, or Node.js reading .git/HEAD or .git/refs files, which may indicate a malicious editor extension harvesting git repository metadata (branch names, commit refs) as observed in the Open VSX 'evil twin' extension campaign.
This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.
Detects a sequence of potentially malicious activities on a Windows host: a batch script command referencing AMSI bypass, followed within 30 minutes by a registry modification affecting Windows SmartScreen settings, and culminating in a silent MSI installation (msiexec.exe /qn). This pattern is consistent with an adversary attempting to disable security controls to facilitate an stealthy software installation.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Threat actors are exploiting the recently Discovered WordPress Vulnerability. Vulnerability Management platform like defender not fully capable of identifying the vulnerable WordPress Core Application being installed on the organizations Servers. If you are using Defender XDR, here's the KQL to hunt for WordPress Installed Linux and Windows Servers.
Detects creation of a VS Code/Open VSX extension folder whose name reuses a known legitimate vendor namespace (AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, US government) but is published at an implausibly low version (0.0.1 or 0.0.2), matching the 'evil twin' extension-confusion pattern.
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects the creation of files named 'svchost.exe' within user Documents directories, excluding files located in 'C:\Windows\System32'. This rule identifies potential file masquerading, a tactic often used by adversaries to hide malicious binaries within legitimate system process names during post-exploitation activities.
This rule detects network connections to known malicious IP addresses, domains, and URLs, as well as the execution or presence of files with known malicious SHA256 hashes. It correlates network and file events to identify potential compromise indicators.
This rule detects the extraction of a specific Python 3.13.3 embedded runtime archive ('python-3.13.3-embed-amd64-with-pip.zip') using tar.exe with a passphrase, targeted specifically at the Microsoft Edge User Data directory. The execution is flagged when initiated by processes like AutoHotkey or processes originating from within the Edge User Data directory, which is indicative of the 'Edgecution' malware suite's method for establishing a persistent native messaging host to facilitate malicious browser-based activity.
Detects deletion, modification, or renaming of the Chrome 'passkey_enclave_state' file by a process other than Chrome. This file contains sensitive wrapped identity, User Verification (UV) private keys, and security domain secrets. Unauthorized access or deletion of this file is indicative of an attempt to force Chrome to re-onboard the device, which may expose key material during the re-registration flow.
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects Node.js processes executing code from compromised Joyfill beta packages (@joyfill/layouts or @joyfill/components). The rule triggers when a Node.js process attempts to load specific files or interact with file paths associated with these packages, which are indicative of an attempt to bypass standard installation security measures (like --ignore-scripts) and execute malicious code during package import.
Detects the HeptaX keylogger by identifying a specific sequence of suspicious process behaviors: installation of WH_KEYBOARD_LL or WH_MOUSE_LL hooks, creation of a specific "Microsoft_SysInternal_logger-v2.0" mutex, elevating the process priority class to high or realtime, and writing log files to a directory masquerading as a OneDrive folder within ProgramData.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Detects access to the attacker-controlled sandbox/dependency-check file (C:\ProgramData\AppSreen\logs\appscreen.log) that the STAC4749 first-stage loader verifies before proceeding with execution.
An adversary may be leveraging the compromised Visual Studio Code extension nrwl.angular-console-18.95.0 to gain initial access, execute malicious code, or compromise developer environments through trusted VSCode extension installations.
Page 61 of 139