Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,884
5,164
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of mshta.exe with arguments pointing to remote URLs or containing JavaScript. This behavior is commonly associated with phishing campaigns where attackers use fake CAPTCHA lures to trick users into executing malicious scripts via mshta.exe, often launched directly from Windows Explorer (e.g., from a downloaded file).
Detects the execution of known Python scripts (CES_Enroll.py, ntlm_ces_relay.py, ces_negotiate_ntlm.py) often associated with NTLM relay attacks or forced authentication techniques. These scripts leverage Python to interact with authentication protocols or relay requests.
Detects a non-root user invoking 'busctl call' against the system bus - the core of the
ptrace_may_dream / AccountsService abuse path (CVE-2026-46333 class). Enriched by decoding
the D-Bus call target (service/member), a CallCategory verdict (AccountsService account
modification, systemd run-as-root, polkit, PackageKit, generic mutating call), a burst
counter that surfaces the pidfd_getfd race loop, RiskScore / TriagePriority and DeviceInfo
context. NOTE: the FD-theft primitive itself is invisible to MDE; this detects the busctl
trigger and account-modification aftermath. Detection logic adapted from Elastic Security Labs.
ptrace_may_dream / AccountsService abuse path (CVE-2026-46333 class). Enriched by decoding
the D-Bus call target (service/member), a CallCategory verdict (AccountsService account
modification, systemd run-as-root, polkit, PackageKit, generic mutating call), a burst
counter that surfaces the pidfd_getfd race loop, RiskScore / TriagePriority and DeviceInfo
context. NOTE: the FD-theft primitive itself is invisible to MDE; this detects the busctl
trigger and account-modification aftermath. Detection logic adapted from Elastic Security Labs.
Detects potential 'ClickFix' activity where a browser or file explorer process initiates a shell (e.g., cmd, powershell, osascript) with command arguments indicative of remote script execution, obfuscated commands, or web-based payload downloading. This pattern matches known social engineering tactics that entice users to copy-paste malicious code into a system shell.
This rule monitors for various indicators of compromise (IOCs) including malicious domains, IP addresses, specific URI paths, file names, and file hashes. It aggregates telemetry from network, file, process, and certificate events to detect potential threats interacting with known bad infrastructure or executing suspicious files associated with malware campaigns.
This rule monitors for network communication with known malicious infrastructure (IPs/domains) and the execution of specific suspicious file names. It correlates device network events, file system activity, and process execution, specifically flagging attempts to execute MSI installers or other binaries associated with the identified threat indicators.
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
This rule detects suspicious activity where a user account executes multiple disparate reconnaissance or discovery commands within a 30-minute window. It monitors for the execution of common Windows administration and discovery tools like dsquery, nltest, net, nslookup, and tasklist using specific, non-standard arguments indicative of network or domain reconnaissance.
Detects the 'mscopilot.exe' binary performing token manipulation operations (DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken) followed by the creation of a new process with a different security context (CreateProcessAsUserW) within a five-minute window, indicative of C2 agent functionality.
Detects the 'ClickFix' attack pattern where explorer.exe (typically via a Run dialog interaction) spawns a command shell (PowerShell, cmd, or mshta) using obfuscated flags combined with execution indicators (download/execution), which then subsequently spawns a secondary child process. This chain provides high-confidence evidence of malicious intent compared to isolated process executions.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, powershell, diskshadow) to delete volume shadow copies or backup catalogs. This activity is commonly associated with ransomware operations intended to inhibit system recovery.
Detects usage of the Rclone utility (or renamed binaries) to transfer data to various cloud storage backends (S3, Mega, pCloud, SFTP, WebDAV). The detection correlates this activity with the execution of common archival tools (7-Zip, WinRAR, TAR) within one hour prior to the data transfer, which is a common behavior of adversaries preparing data for exfiltration.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Detects the use of Mimikatz-style command-line arguments to manipulate Kerberos tickets, including ticket requests, purges, and golden/silver ticket creation attempts.
Detects the use of Mimikatz 'sekurlsa::pth' command for credential manipulation, or the occurrence of SMB/Windows administrative share access (ADMIN$, C$) potentially indicating lateral movement activities.
Detects execution of AgtaBackupAgent.msi via command-line tools such as PowerShell or msiexec.exe. This activity is monitored as it may indicate an attempt to install backup software or potential malicious masquerading using the MSI installer, particularly when using silent flags or accessing from temp directories.
Detects execution of AgtaBackupAgent.msi via command-line tools such as PowerShell or msiexec.exe. This activity is monitored as it may indicate an attempt to install backup software or potential malicious masquerading using the MSI installer, particularly when using silent flags or accessing from temp directories.
Detects the abuse of the Windows built-in utility 'certutil.exe' to download files from remote locations using the 'urlcache', 'verify', or 'verifyctl' arguments. Attackers often leverage this LOLBIN to download malicious payloads as it is a trusted system binary.
Page 40 of 976