Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects pkr_mtsi packer samples based on their characteristic use of junk GDI API calls for obfuscation. The rule looks for PE files that import an excessive number of GDI32.dll functions and contain repeated calls to CreateSolidBrush with random color values.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Detects specific User-Agent strings associated with the DDoSia malware, which is used by the NoName057(16) hacktivist group for DDoS attacks. The rule looks for two distinct User-Agent patterns in HTTP traffic.
Detects the creation of abnormally large Windows shortcut (.lnk) files. This is a known TTP of APT36 (Transparent Tribe), who embed PDF content within LNK files to inflate their size and masquerade as legitimate documents to deceive users. The rule specifically looks for .lnk files with a size greater than 1MB.
Detects COLDDRIVER malware loading specific malicious DLLs (machinerie.dll, checkme.dll, iamnotarobot.dll) via rundll32.exe, or the loading of specific malicious DLLs identified by their SHA256 hashes.
Detects SecDelivery.apk - Kimsuky DOCSWAP variant
Detects behavioral patterns
Detects native decryption library
Detects P2B Airdrop variant
Detects Auction delivery app variant
Detects VPN masquerading variant
This rule detects the presence of known malicious browser extensions, specifically "Zoom Stealer Extension" and "Shady Panda Extension", by looking for their unique Extension IDs within file paths or file names on devices. It identifies the first and last seen timestamps, the names of the extensions, their IDs, associated campaigns, and the browsers they target, summarizing this information per device.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects the execution of 'rundll32.exe' with suspicious DLL names in the command line, specifically 'machinerie.dll', 'checkme.dll', or 'iamnotarobot.dll'. Additionally, it identifies the loading of specific malicious DLLs by their SHA256 hashes, which have been associated with ColdRiver (Star Blizzard) activity. This behavior is indicative of potential malware execution or persistence mechanisms.
Detects the installation of malicious npm packages associated with the Shai-Hulud 2.0 supply chain attack campaign.
This rule detects the presence of known malicious browser extensions on devices. It identifies extensions based on a curated list of Extension IDs associated with various threats, including Urban VPN, extensions that turned malicious, general malicious browser extensions, and those involved in Chrome extension supply chain attacks. The rule queries `DeviceTvmBrowserExtensions` to find any activated extensions matching these IDs.
Detects the execution of AutoHotKey (.ahk) or AutoIt (.au3) scripts from common staging directories such as C:\Users\Public\ or C:\Temp\. This is a known technique used by malware like DarkGate to stage and execute its payload.
This rule detects the use of bitsadmin to download specific Python scripts ('libsystemhealthcheck.py' or 'libcryptopydatasize.py') from the 'inspectguarantee.org' domain. This activity is associated with the COLDDRIVER (Star Blizzard) threat group, which uses BITSAdmin for ingress tool transfer.
This rule detects the presence of known malicious browser extensions, specifically Urban VPN, Urban Browser Guard, Urban Ad Blocker, and 1ClickVPN Proxy, across Chrome and Edge browsers. It identifies these extensions by searching for their unique 32-character Extension IDs within file paths or file names associated with device file events. The rule then enriches the findings with the extension's name and the browser it belongs to.
Page 176 of 232