Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of the Windows 'fsutil' utility with the 'setZeroData' argument to zero out file content. This technique is often used by adversaries to perform data destruction or prevent file recovery.
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
Detects Grixba infostealer activity associated with the Play Ransomware group. The rule monitors for network host and share enumeration using net.exe and WMIC, and tracks the execution of the Grixba binary GT_NET.exe from the non-standard path C:\Users\Public\Music\.
Detects the use of rundll32.exe to execute the MiniDump function of comsvcs.dll, a known technique for dumping the memory of the Local Security Authority Subsystem Service (LSASS) process to gain access to stored credentials.
Detects the execution of unauthorized network scanning tools (e.g., netscan.exe, n.exe), usage of reconnaissance PowerShell scripts like Invoke-ShareFinder, or the creation of common reconnaissance artifacts such as 'delete.me' or 'shares.txt'. The rule monitors Sysmon process creation, network connection events, and file creation events to identify activities consistent with internal network discovery and lateral movement preparation.
Detects the loading of known vulnerable drivers (rwdrv.sys, hlpdrv.sys) used for potential Bring Your Own Vulnerable Driver (BYOVD) attacks, accompanied by evidence of antivirus tampering through process execution or the creation of suspicious directories related to AV killing utilities.
Detects unauthorized credential dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies suspicious use of system utilities like 'comsvcs.dll' via rundll32, cross-process handle access by unauthorized processes, and the execution of offensive security tools such as lsassy and crackmapexec.
Detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for suspicious browser process spawning scripting child processes (powershell.exe, wscript.exe, etc.), unusual DNS requests to Microsoft login/Graph API endpoints from scripting hosts, and direct non-browser access to browser cookie database files.
Detects reconnaissance activity associated with Akira ransomware, including PowerShell-based share enumeration (Invoke-ShareFinder, Get-NetShare), execution of unauthorized network scanning tools (e.g., SoftPerfect NetScan from non-standard paths), and the use of 'net view /domain' commands to identify accessible network resources.
Detects the creation of a scheduled task named 'WindowsUpdateTempFileCleanUp' or suspicious scheduled task naming conventions associated with the BeepRAT malware. The rule specifically monitors for the execution of a TCC loader chain, often masquerading or leveraging configurations located within the %LOCALAPPDATA%\TCC directory to maintain persistence with high privileges.
This rule monitors system activity for the presence of specific file names, paths, and image loads associated with known malware families, specifically BlueHammer, RedSun, UnDefend, Bluekit, and libpwn. The rule evaluates process creation, file creation, and DLL load events across EDR and endpoint logs to identify potentially malicious indicators.
Detects potential lateral movement by the Akira ransomware group. The rule triggers when a Windows interactive RDP logon (LogonType 10, NTLM V2) occurs on a target host while the source host simultaneously exhibits process execution of the 'AdgNsy.exe' file, which is a known agent associated with Akira's command-and-control infrastructure.
Detects malicious network discovery and enumeration activities associated with Akira ransomware. This includes the execution of SoftPerfect Network Scanner (netscan.exe) for port/service scanning and the use of the PowerView Invoke-ShareFinder module for identifying accessible network shares, often observed in post-compromise intrusion phases.
Detects reconnaissance activities targeting binaries or modules containing libssh2 library references or specific PHP symbol offsets (e.g., zend_execute_internal, zif_system). This rule monitors for common administrative and debugging tools like ldd, strings, readelf, and nm being used to scan files for sensitive symbols or version information, as well as specific PHP enumeration patterns and validation script executions, which are commonly associated with the triage process for CVE-2026-55200.
Detects the execution of the VSCode npm infostealer campaign, specifically identifying the usage of a fake eslint loader named 'vscode-eioesocxetd.js'. This malware performs sandbox and environment checks for CI/CD, cloud, and containerized environments (AWS, Azure, GCP, GitHub Codespaces, etc.) to evade analysis before proceeding to deploy infostealers or backdoors.
Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.
Detects the use of the native Windows wbadmin.exe utility to initiate a backup that targets sensitive system files, such as the Active Directory database (ntds.dit) or registry hives (SYSTEM, SECURITY). This behavior is characteristic of an attempt to stage sensitive credentials or system configuration data for offline analysis or exfiltration, often performed as part of a credential dumping effort.
Detects attempts to perform credential dumping from the LSASS process memory using the built-in Windows binary rundll32.exe to execute comsvcs.dll. The rule monitors for specific command-line arguments and common output file paths associated with manual dumping or automated tools like lsassy.
Detects the use of rundll32.exe to invoke the MiniDump function of comsvcs.dll to create a memory dump of the Local Security Authority Subsystem Service (LSASS). This technique is a common method for dumping LSASS memory to harvest credentials, often used by tools like lsassy and various post-exploitation frameworks. The rule monitors for the specific command line patterns used in this attack, including referencing comsvcs.dll and the 'full' dump argument, initiated by suspicious parent processes frequently seen in lateral movement scenarios.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects potential exploitation of ImageMagick vulnerabilities where Ghostscript delegates are used to achieve arbitrary code execution. The rule monitors for suspicious Ghostscript command-line arguments (e.g., missing or disabled -dSAFER), child process creation (spawning shells or interpreters), execution of network tools, unauthorized file modifications with script/binary extensions, and outbound network connections initiated by Ghostscript processes.
Page 402 of 976