Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects PowerShell or WMIC commands used by Starland RAT to gather system hardware identifiers, RAM capacity, and installed antivirus products via CIM/WMI queries during victim profiling.
This rule monitors for processes, file names, or command lines that contain the string 'telepuz', which is indicative of a specific malware or malicious toolset. It alerts on any occurrence within process image names, process command lines, or file paths.
Detects the use of command-line tools employing recursive search patterns (e.g., -Recurse) targeting document file extensions (PDF, DOCX, XLSX). This activity is often associated with the staging phase of an exfiltration attempt, where an adversary identifies sensitive files across a directory structure before collection.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects the execution of python.exe or pythonw.exe from the LogiOptionsPlus temporary directory within AppData. This behavior is atypical for standard Logitech software operation and may indicate the execution of arbitrary scripts or malicious payloads masquerading under a legitimate software path.
Detects the execution of 'az role assignment list' using the Azure CLI. This command is commonly used by adversaries to enumerate existing role assignments in an Azure environment, aiding in permission discovery and identifying potential targets for privilege escalation.
Detects rundll32.exe loading davclnt.dll, which triggers the WebClient service to auto-start and perform a network callout to retrieve WebDAV-hosted content.
Execution of Fo-Binary.exe Loader
Cortex XDR
Detects the execution of a process named 'Fo-Binary.exe', which is commonly associated with loader activity. This rule monitors process creation events to identify the initialization of this specific binary.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.
Detects 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that explicitly include username and password flags in the command line string. This behavior may indicate credential usage for registry authentication.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects instances where a git repository is cloned, followed by the execution of VS Code, and subsequently the triggering of an automated task (via tasks.json or .vscode directory) by that VS Code instance within a short timeframe. This sequence may indicate an attacker attempting to execute code or automation routines immediately after cloning a malicious or compromised repository.
Detects the execution of the Windows error reporting tool 'createdump.exe' with command-line arguments referencing 'lsass.exe' or the '--full' flag, which is commonly used by adversaries to perform credential dumping from the Local Security Authority Subsystem Service (LSASS) process memory.
Detects the execution of the McUploader component associated with the GigaWiper malware, which is used for file staging and exfiltration.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
This rule detects execution of specific functions or command-line arguments derived from the GigaWiper / FlockWiper malware family. These functions are associated with destructive activities such as file discovery, sorting, reading, and secure encryption or deletion of files, indicative of a wiper-style attack.
This rule detects execution of specific functions or command-line arguments derived from the GigaWiper / FlockWiper malware family. These functions are associated with destructive activities such as file discovery, sorting, reading, and secure encryption or deletion of files, indicative of a wiper-style attack.
Detects the execution of GigaWiper malware registry modules. The rule monitors command-line activity for specific binary names associated with the GigaWiper malware family that perform registry modifications, such as key creation or deletion.
Detects modification of targeted registry keys commonly used for persistence
and defense evasion via startup execution.
and defense evasion via startup execution.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Page 323 of 977