Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects potential credential dumping activity targeting sensitive files like NTDS.dit, SAM, and SYSTEM hives. This rule monitors for three primary indicators: unauthorized invocation of vssuirun.exe (often used for Volume Shadow Copy manipulation), exploitation of print command utilities to access sensitive system files, and the staging of critical credential files into temporary directory paths.
Detects network, DNS, and process-level activity associated with BQTLock ransomware command-and-control communication, specifically targeting Telegram Bot API and Discord webhook traffic originating from non-standard (non-browser/non-messaging) processes.
This rule detects the execution of known offensive security and post-exploitation toolsets (such as Impacket, Metasploit, CrackMapExec, or NetExec) when initiated from virtualization processes like QEMU. This pattern is indicative of an adversary executing malicious payloads from within a virtual machine or using virtualization software as a proxy for malicious activity on the host.
Detects the execution of wmic.exe with arguments typical for remote process creation, such as using the /node switch to execute commands on remote systems. This behavior is commonly associated with lateral movement or remote administration.
Detects a sequence of events on a single host within a 10-minute window involving both the deletion of Volume Shadow Copies (using vssadmin.exe or wmic.exe) and the execution of ESXi management commands (using esxcli or vmware binaries). This behavioral pattern is often indicative of ransomware attempting to inhibit system recovery and interfere with virtualized infrastructure components concurrently.
This rule detects qemu-system processes acting as parents for known tunneling or network utility tools, or qemu-system instances explicitly configured with suspicious command-line parameters (e.g., tap, socket connect, virtio-net) indicative of covert command and control (C2) communication. This behavior is associated with threat actors using Alpine Linux virtual machines within QEMU to bypass host EDR visibility.
Detects the execution of BQTLock ransomware loader components (start.exe or BQT.exe) that contain embedded PyInstaller environment artifacts. The rule monitors for processes that incorporate specific environment variables associated with PyInstaller-packaged binaries, which are often used by this malware to detect debugger presence and sandbox environments before proceeding with its primary malicious functionality.
Detects the simultaneous execution of QEMU virtualization processes and post-exploitation tools (Metasploit, Impacket, Havoc, NXC) on the same host. This combination is indicative of an adversary using a local virtual machine to tunnel or pivot lateral movement activities while leveraging post-exploitation frameworks on the host system, a behavior observed in specific campaigns.
This rule detects instances where Microsoft Edge or Google Chrome are launched with the --load-extension command line argument pointing to non-standard or suspicious directories (such as Temp, Downloads, or ProgramData). These locations are often used by malicious extensions to evade detection. The rule also flags instances where these browsers are launched by suspicious parent processes, which may indicate automated installation or control by malicious actors.
Detects the creation or modification of inbox rules via PowerShell, specifically targeting cmdlets commonly used by attackers to hide phishing indicator emails, security alerts, or C2 communications by moving or deleting them into folders like Junk, Deleted Items, or Archive. The rule monitors for both direct usage on the endpoint and remote administration patterns via Exchange Online/EWS remoting.
Detects execution of potential BeepRAT loaders such as tcc.exe, luajit.exe, or hfy.exe that exhibit evasive behavior by loading amsi.dll. This activity is indicative of in-memory shellcode execution attempting to disable security features like AMSI, ETW, or WLDP before loading malicious payloads.
Detects attempts to access or copy the Active Directory domain database (NTDS.dit), which contains sensitive credential material. The rule monitors for the use of built-in administrative tools such as esentutl, ntdsutil, vssadmin, and wbadmin, as well as file copy utilities (robocopy, xcopy) when specifically targeting the NTDS directory or volume shadow copies containing the database file.
This rule detects common methods used by adversaries to perform credential dumping by accessing the memory of the Local Security Authority Subsystem Service (LSASS). It specifically flags the use of Procdump to create a memory dump of LSASS, the use of the native Windows utility comsvcs.dll via rundll32 to dump process memory, and the creation of LSASS dump files via the Windows Task Manager.
Detects browser processes (Chrome, Edge, Firefox, IE) being launched with a URL containing a crafted Microsoft 365 Copilot Search parameter (q=) with an unusually long command line. This pattern is indicative of potential exploitation attempts such as CVE-2026-42824 (SearchLeak), where attackers inject malicious payloads or HTML/script tags into the search query string to be processed by the browser.
Detects potential local privilege escalation activity involving AnyDesk. The rule monitors for malicious registry modifications (COM hijack), spawning of suspicious child processes by AnyDesk, creation of specific named-pipe artifacts, unsigned DLL loads from user-writable directories, and unauthorized cross-process injection, potentially linked to CVE-2026-20253.
Detects DLL side-loading activity associated with the Kazuar backdoor, where legitimate executables (LaunchGFExperience.exe or vncutil64.exe) are executed from unusual directories (Brother Printer or Sony Audio drivers) to load a malicious DLL (LaunchGFExperienceLOC.dll).
Detects Microsoft Edge or Google Chrome spawning suspicious shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe), which is characteristic of the StegoAd browser extension campaign. The rule specifically flags browser processes launching script interpreters with command-line arguments containing obfuscated content (e.g., base64, eval) or references to specific image files (e.g., loading.webp, .woff2) used for steganographic payload delivery.
Detects the installation, service creation, and network activity associated with Tailscale VPN on endpoints. The rule monitors for process creation of Tailscale binaries, creation of associated registry keys, and outbound network traffic to Tailscale infrastructure or the internal 100.64.0.0/10 CGNAT mesh range, which may indicate unauthorized persistence or remote access.
Detects instances where Python-related package management tools (python.exe, pip.exe) initiate external network connections shortly after executing install-related commands. This behavior may indicate an attempt to install malicious packages from untrusted repositories or a software supply chain compromise.
Detects instances where Python-related package management tools (python.exe, pip.exe) initiate external network connections shortly after executing install-related commands. This behavior may indicate an attempt to install malicious packages from untrusted repositories or a software supply chain compromise.
Detects unauthorized or suspicious installation and configuration of the OpenSSH server on Windows endpoints. This rule monitors for process creation of OpenSSH-related binaries, configuration of SSH services (e.g., via sc.exe, PowerShell, or winget), and modification of SSH-related configuration files and registry keys, which are often indicative of attackers establishing persistent backdoor access.
Page 358 of 977