Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects attempts to disable or tamper with Microsoft Defender Antivirus through various methods, including modifying registry policies, stopping the WinDefend service, executing PowerShell commands to alter preferences, or adding arbitrary exclusions via WMI.
Detects reconnaissance activities performed on compromised web servers, including the enumeration of installed security software, installed applications via WMI or registry queries, and service/process listing. These actions are often observed as a precursor to defense impairment or further exploitation originating from web server processes like w3wp.exe.
Detects attempts to modify file timestamps (CreationTime, LastWriteTime, LastAccessTime) using PowerShell Set-ItemProperty cmdlets or command-line tools like 'touch'. This behavior is often associated with adversary attempts to hide artifacts or modify forensic timelines, specifically when targeting directories associated with web servers.
Detects attempts to uninstall, disable, or remove ModSecurity Web Application Firewall (WAF) modules on IIS or Apache servers. This behavior often indicates an adversary attempting to impair security defenses by disabling WAF protection to facilitate further malicious activity, such as web shell deployment or exploitation.
Detects anomalous child process execution from common web browsers often associated with Browser-in-the-Browser (BitB) attacks. The rule correlates browser-spawned processes like PowerShell, cmd, or mshta with concurrent, suspicious network activity targeting login or account-related domains outside of expected conferencing platforms.
Detects the removal or uninstallation of the ModSecurity Web Application Firewall (WAF) module across Windows (via appcmd.exe) and Linux (via package managers or apxs). Adversaries often disable security controls like ModSecurity to facilitate the exploitation of web vulnerabilities or to maintain persistence without triggering defensive alerts.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Shutdown Button". No public in-the-wild intel reference available; correlate before alerting.
This rule detects when common web browsers or messaging applications spawn suspicious child processes such as command-line interpreters (cmd, powershell, wscript, mshta) or processes associated with remote access tools (NetSupport Manager). Such behaviors are often indicative of exploitation, malicious payload delivery, or unauthorized remote access.
This rule detects known credential dumping activity, specifically focusing on the execution of Mimikatz (or renamed variants) and the use of built-in system tools like comsvcs.dll or procdump to dump lsass.exe process memory.
Detects a host performing multiple distinct network reconnaissance commands in a short period, which is indicative of an attacker profiling the network configuration and environment of a compromised system.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
Detects the execution of WinRAR or rar.exe with command-line arguments often used for staging data, including file addition, archive creation, and extraction. This activity is frequently associated with the preparation of files for exfiltration or the unpacking of malicious payloads.
This rule detects potential file timestamp manipulation (timestomping) and suspicious file operations commonly associated with web shell installation on Windows systems. It monitors for PowerShell commands, touch.exe execution, and cmd.exe file copy operations directed at web directories, as well as file write events involving specific known web shell filenames.
Detects indicators of Akira ransomware activity, specifically the deletion of Volume Shadow Copies using vssadmin, the creation of known Akira ransom notes (akira_readme.txt, restore_files.txt), and the generation of files with the .akira extension.
Detects instances where a process executes multiple system enumeration commands (Defender status, service query, product enumeration, or process listing) within a short window, often associated with reconnaissance activity.
Detects execution of WinSCP.exe followed by network connections to standard SFTP (port 22) or SCP (port 115) ports. This rule aggregates command-line activity and network connection data to identify potential file transfer or exfiltration operations initiated by the WinSCP utility.
Detects the use of WMIC to interact with the MSFT_MpPreference WMI namespace to add folder or file extension exclusions to Microsoft Defender. This technique is often used by attackers to exempt malicious files or tools from being scanned by security software.
Detects the execution of the NetSupport RAT client process (client32.exe). This tool is often abused by threat actors for remote control, frequently deployed following social engineering lures such as ClickFix or BitB (Browser-in-the-Browser) attacks.
Detects the execution of WinRAR or rar.exe with command-line arguments specifying password protection or outputting to common staging directories. This behavior is frequently associated with attackers staging and compressing sensitive data prior to exfiltration.
Detects potential CastleLoader delivery by monitoring for suspicious child process executions (e.g., PowerShell, cmd, mshta, wscript, cscript) spawned directly by common browser or email client parent processes. This behavior is indicative of a user interacting with a malicious phishing link or attachment as part of a malware delivery chain.
This rule detects instances where common web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe) or mshta.exe spawn shell processes (powershell.exe, pwsh.exe, cmd.exe) with suspicious command-line arguments. These arguments often indicate malicious activity such as downloading and executing code, using encoded commands, or hiding the execution window, which are typical indicators of a web-based delivery or exploitation attempt.
Page 419 of 976