Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects potential brute force or password spraying attacks by monitoring high volumes of authentication failures on an endpoint within a 5-minute window. Additionally, it identifies the execution of processes associated with multi-factor authentication (MFA) or single sign-on (SSO) clients, which could indicate an adversary attempting to bypass or manipulate MFA mechanisms.
Detects instances of PowerShell or PowerShell Core (pwsh) launched with encoded command line arguments (-encodedcommand, -enc, -ec). This is a common technique used by attackers to obfuscate malicious scripts and payloads by passing them as Base64 encoded strings to avoid simple static analysis.
Detects the deletion of volume shadow copies using standard Windows utilities such as vssadmin.exe, wmic.exe, or PowerShell. This behavior is a common indicator of ransomware activity aimed at preventing system recovery.
Detects the execution of interactive shell or scripting processes (e.g., cmd.exe, powershell.exe, wscript.exe) directly or indirectly spawned by the Microsoft Defender service (MsMpEng.exe). The rule identifies processes running at SYSTEM integrity in an interactive user session, which is indicative of a TOCTOU exploit against the Defender quarantine pipeline.
Detects suspicious activities related to the RoguePlanet vulnerability (CVE-2026-50656), characterized by the creation of temporary directory structures in user folders, mounting of disk images (ISO/VHD) from user-accessible paths, and subsequent execution of binaries from these temporary workspaces.
Detects persistence attempts via modifications to Windows Registry Run keys, either through direct registry operations or via the execution of 'reg.exe'. It specifically flags suspicious registry value data (e.g., paths in Temp or AppData) and instances where non-standard binaries are utilized to perform these operations.
Detects indicators of ransomware-related anti-forensic behavior, including the deletion of Volume Shadow Copies via vssadmin or wmic, disabling system recovery via bcdedit, and the clearing of Windows event logs via wevtutil or system event log clearing events.
This rule detects the execution of common remote administration tools (PsExec, PaExec, RemCom) specifically on devices identified as domain controllers based on their naming convention.
This rule monitors for potential spearphishing campaigns by tracking two behaviors: the delivery of emails containing known malicious URLs or lure-themed attachment names via email gateway logs, and the subsequent execution of files extracted from archives or matching lure patterns by EDR agents on endpoints.
Detects instances where a user account is created or modified (e.g., added to a local admin group) shortly after a network logon event (Logon Type 3 or 10). This behavioral correlation is highly indicative of lateral movement followed by local privilege escalation or persistence establishment.
This rule detects the execution of Microsoft Quick Assist (msra.exe or quickassist.exe) on endpoints. It elevates the risk score if the event is preceded by Microsoft Teams activity within 30 minutes or occurs on a host exhibiting high volumes of email traffic, which may indicate remote access tool abuse following a social engineering or phishing attempt.
Detects the use of common archive utilities (7zip, WinRAR, zip) to interact with files located in suspicious directories commonly used for data staging (AppData, Temp, Users Public). The rule tracks multiple occurrences of these commands by the same user on a host to identify potentially malicious collection and staging activities before exfiltration.
Detects suspicious processes commonly associated with malicious activity establishing outbound network connections to Azure Web Apps domains. The rule aggregates connections to identify potential beaconing behavior by monitoring connection frequency and duration, flagging activity initiated by binaries frequently used for living-off-the-land attacks such as powershell.exe, rundll32.exe, and others.
Detects the execution of wmic.exe with specific WMI queries (Win32_ComputerSystem, Win32_PhysicalMedia, Win32_PnPEntity) commonly used for system profiling and hardware discovery by threat actors like TA4922. The rule assigns a higher risk score when the process is launched from potentially suspicious locations such as user-writable or temporary directories.
This rule detects potentially malicious activity related to Group Policy Object (GPO) manipulation, including the execution of the SharpGPOAbuse tool and suspicious PowerShell commands intended to modify GPOs for persistence or privilege escalation, such as adding local administrators, creating immediate tasks, or applying domain-level policies.
This rule monitors for new user account creation (Event ID 4720) that is either performed by a known suspicious process name or initiated by a non-standard provisioning account. It additionally correlates these creation events with subsequent additions of the new account to the local Administrators group (Event ID 4732) to flag potential privilege escalation attempts.
Detects the execution of QEMU processes configured with specific network redirection flags (hostfwd) targeting standard SSH ports, or utilizing suspicious file paths (e.g., .db, .dll) as virtual disk backing files. This behavior is indicative of adversaries utilizing QEMU to establish covert reverse SSH tunnels or staging malicious artifacts within virtualized environments.
Detects suspicious behavior associated with ADNotificationManager.exe, including DLL side-loading of vcruntime140_1.dll, loading of DLLs from user-writable directories (potential DLL hijacking), and the spawning of Rclone.exe for potential data exfiltration via SFTP.
Detects potential remote code execution (RCE) attempts targeting Langflow that manifest as the spawning of child shell processes or the execution of curl/wget commands to download and execute malicious scripts (specifically 'isp.sh') from the IP address 83.142.209.214. It also monitors for Python-based execution patterns using 'os.system' to drop or execute these payloads.
Detects anomalous child process creation from typical web and application server processes (IIS w3wp.exe or Openfire Java processes). This behavior is consistent with post-exploitation activity following web application vulnerability exploitation, specifically web shell deployment and execution of reconnaissance or secondary payload staging commands.
This rule detects token manipulation and impersonation behaviors characteristic of Cobalt Strike post-exploitation activity. It specifically identifies instances where common child processes (cmd.exe, powershell.exe, net.exe, whoami.exe) are spawned from non-standard parent processes associated with Cobalt Strike payloads (e.g., rundll32.exe, msiexec.exe, svchost.exe), often accompanied by a discrepancy between the effective username and the parent process username or the use of discovery tools post-impersonation.
Page 372 of 977