Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
No description available.
Detects access to the attacker-controlled sandbox/dependency-check file (C:\ProgramData\AppSreen\logs\appscreen.log) that the STAC4749 first-stage loader verifies before proceeding with execution.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects a downloaded archive that does not begin with the standard ZIP local file header 'PK' magic bytes yet still contains valid ZIP central directory or end-of-central-directory signatures alongside Edgecution-specific package content (extension/background.js path, embedded python-3.13.3-embed-amd64-with-pip.zip runtime, or the com.ppeasqabfpxcz.api native messaging host id), consistent with the Edgecution/UNC6692 technique of stripping PK bytes from archives (e.g. patch3265343.a) before an AutoHotkey stager reconstructs bsvqikydknqqk.zip by prepending 0x50 0x4B at runtime
This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.
This query performs comprehensive field extraction and normalization on SentinelOne Deep Visibility raw logs. It acts as a parsing and preparation layer to structure diverse event categories (process, network, file, registry, authentication, and task events) into a standardized format for security analysis, triage, and threat hunting.
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
Detects anomalous, high-volume file access (creation, modification, or renaming) targeting sensitive extensions (e.g., .key, .pem, .pfx) within document directories by unsigned processes. It also detects similar high-volume file access behavior that occurs immediately following the mounting of a removable USB device, consistent with CornFlake RAT data exfiltration patterns.
Detects creation of an encrypted companion payload file with a .dat extension inside the Windows Startup folder, consistent with the TriBack Loader triad (signed binary + sideloaded DLL + encrypted .dat companion) being staged for persistence. Intended as a correlation input paired with detection of the signed host binary drop in the same folder.
Detects creation of an encrypted companion payload file with a .dat extension inside the Windows Startup folder, consistent with the TriBack Loader triad (signed binary + sideloaded DLL + encrypted .dat companion) being staged for persistence. Intended as a correlation input paired with detection of the signed host binary drop in the same folder.
Threat actors are exploiting the recently Discovered WordPress Vulnerability. Vulnerability Management platform like defender not fully capable of identifying the vulnerable WordPress Core Application being installed on the organizations Servers. If you are using Defender XDR, here's the KQL to hunt for WordPress Installed Linux and Windows Servers.
Detects access to the attacker-controlled sandbox/dependency-check file (C:\ProgramData\AppSreen\logs\appscreen.log) that the STAC4749 first-stage loader verifies before proceeding with execution.
Detects the execution of tar.exe with passphrase-protected extraction flags (-xf and --passphrase) originating from or operating within a Microsoft Edge User Data directory. This behavior aligns with the 'Edgecution' malware deployment technique, where attackers leverage Edge application paths for staging and executing malicious payloads, as observed in UNC6692 campaigns.
Detects TriBack Loader signed host binary (avk.exe or hostfxr.dll) being written to the Windows Startup folder. Correlation input paired with the encrypted companion file drop detection.
Detects creation of an encrypted companion payload file with a .dat extension inside the Windows Startup folder, consistent with the TriBack Loader triad (signed binary + sideloaded DLL + encrypted .dat companion) being staged for persistence. Intended as a correlation input paired with detection of the signed host binary drop in the same folder.
Detects instances where processes other than common Chromium-based web browsers attempt to access sensitive files within the browser's User Data directory, such as Login Data, Cookies, or Web Data. This behavior is often indicative of credential theft or session hijacking attempts by unauthorized software or adversaries.
Detects a process performing cryptocurrency wallet/messenger folder discovery (Ledger Live, Atomic, Exodus, Guarda, KeepKey, BitBox02, Signal) combined with antivirus product enumeration (via rootSecurityCenter2, AntiVirusProduct, or WMI SELECT displayName queries) within the same host/process/time window, consistent with CountLoader host-profiling behavior.
Detects file access/read of the in-cluster Kubernetes service account token path or a user's kubeconfig file by a non-standard binary (e.g. scripting interpreter, shell, or network utility) rather than known Kubernetes/orchestration tooling. Narrowed to reduce false positives from legitimate kubectl, helm, kubelet, and container runtime processes that routinely read these credentials.
Page 62 of 139