Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the creation or modification of files on a device that match a list of known malicious SHA256 hashes. It identifies potential malware presence based on file integrity.
This rule detects modifications to specific registry keys that are commonly used for persistence by malware. The rule looks for Event ID 4657 (A registry value was modified) and checks if the ObjectName corresponds to known malicious registry paths related to Run keys, RunOnce, or service configurations. This indicates an attempt to establish persistence or alter system behavior for malicious purposes.
This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.
This rule detects suspicious execution patterns involving 'wscript.exe' or 'cscript.exe' that utilize common COM objects or VBScript, while excluding executions from standard Windows and Program Files directories. It specifically looks for multiple unique command line executions within a two-hour window from the same device and account, indicating potential malicious script activity.
Detects PowerShell downloading and executing remote payloads using invoke-restmethod/irm and invoke-expression/iex. This technique is widely used by ClearFake and PS1Bot malvertising campaigns to execute in-memory payloads directly from C2 servers.
This rule identifies processes establishing synchronization objects (mutexes) that start with the hardcoded prefix 'Global\EVOLUTION'. This pattern is indicative of the EVOLUTION stealer malware execution, as it uses this specific mutex naming convention to ensure only one instance of itself is running.
This rule detects HTTP traffic where the client body contains a long string (100 or more characters) composed exclusively of uppercase letters and digits 2-7, potentially followed by padding characters. This pattern is indicative of custom alphabet base encoding, often used in Command and Control (C2) communications to obfuscate data.
This rule detects the delivery of a payload associated with the 'Incognito Token Theft Tool'. It specifically looks for the case-insensitive string 'list_tokens' within HTTP response body content flowing from a server to a client. This string is indicative of the tool's functionality, which often involves listing tokens for exfiltration or further abuse, suggesting an attempt at privilege escalation or credential access.
This rule detects an unusually high number of downloads of files identified as 'octet-stream' or 'executable' from a single IP address within a one-hour window, based on W3CIISLog data. This behavior could indicate various malicious activities, including the distribution of malware, data exfiltration, or the use of a compromised web server for command and control.
This rule looks for command-line text associated with Atlas remote-access malware checking in to its controller. That check-in means the machine may already be under outsider control. Isolate the host and begin incident response if confirmed. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Token and tick payload URL structure
Cortex XDR
This rule detects network connections where the URL or remote IP address matches a specific pattern indicative of short-lived downloader URLs. These URLs typically contain paired tokens, numeric ticks, and a signature timestamp, often associated with malware distribution ecosystems. The rule leverages XQL to retain actor and causality fields for further investigation.
This rule detects the execution of temporary executables (from common temporary directories like 'temp' or 'appdata\local\temp') that are launched with a command line containing a numeric argument followed by a long Base64-like token. This pattern is often indicative of malware loaders or droppers attempting to evade detection by using obfuscated arguments.
This rule detects the presence of Remcos RAT by looking for specific strings in memory or files. It identifies a complex PowerShell command used for downloading and executing a base64-encoded payload, which is characteristic of Remcos RAT's infection chain. Additionally, it looks for specific file paths and other PowerShell-related strings often associated with Remcos RAT activity.
Detects PowerShell excluding targeted mining executables and RuntimeHost.exe from Microsoft Defender Antivirus scans. This activity is indicative of cryptojacking campaigns attempting to evade detection.
This rule detects suspicious activity where a malicious DLL (AggregatorHost.dll) is injected into a process that then explicitly interacts with 'steam.exe' by accessing its files. This behavior is indicative of malware targeting Steam users, potentially to steal credentials or items.
Detects curl.exe spawned by the batch dropper fetching data.json from known C2 endpoints. This rule correlates process creation events for curl.exe with network connection events to specific C2 domains (kak.is, goingg.is) when 'data.json' is present in the command line.
Correlates the execution of the dropped Synaptics.exe with active outbound network connections, indicative of DarkKomet malware beaconing.
Detects the Dropbox staging URL used to deliver the obfuscated Synaptics archive, specifically looking for network connections to 'dropbox.com' for 'Synaptics.rar' and correlating it with the execution of '._cache_GAME1.exe'. This indicates the download and potential execution of a malicious payload.
Detects secondary payload fetching from the documented malicious domain brightly.to, specifically when initiated by a process named '._cache_GAME1.exe'. This indicates potential malware activity related to malicious Steam Workshop wallpapers.
Correlates mshta connecting to abimj.edu.af followed by a file write of zuidrt.hta or a .vmxx shellcode file, indicative of the Operation XENOFISCAL campaign.
Page 135 of 232