Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
This rule detects the execution of common tools and commands used to perform Kerberoasting, a technique where attackers request Kerberos service tickets for user accounts with Service Principal Names (SPNs) in order to perform offline brute-force attacks to recover plaintext credentials. The rule specifically monitors process creation events for known offensive security tools like Rubeus, as well as specific command-line arguments for 'setspn.exe' and various scripts that can be used to identify potential Kerberoasting targets.
Detects the use of legitimate Windows binaries (certutil.exe and bitsadmin.exe) to download files from remote URLs or perform encoding/decoding operations in suspicious directories (Temp, AppData). This activity is commonly used by adversaries for stage-one malware delivery or tool ingress.
Detects instances of rundll32.exe or regsvr32.exe executing from suspicious locations or with suspicious command-line arguments (e.g., URLs, JavaScript, or script file extensions) initiated by an unsigned process. This is a common technique used to proxy malicious code execution while evading security monitoring.
This rule detects common Cobalt Strike malleable profile named pipe creation events as well as network connections initiated by common LOLBins (Living Off the Land Binaries) that are unsigned, which is a common indicator of beaconing activity.
Detects the execution of script files with .js or .se extensions using wscript.exe or cscript.exe outside of standard system directories. This behavior is consistent with the More_eggs JScript backdoor, which has been utilized by the FIN6 threat group (also known as Skeleton Spider) to establish persistent backdoors for follow-on payload delivery.
Detects the installation or execution of common Remote Monitoring and Management (RMM) tools, including AnyDesk, ScreenConnect, and TeamViewer, by monitoring process creation events. This behavior is indicative of social-engineering-based intrusions by the Scattered Spider (UNC3944/Octo Tempest) threat actor, who often impersonates IT support staff to convince users to run these tools for unauthorized remote access.
Detects the execution of regsvr32.exe with command line arguments containing 'scrobj.dll' and '/i:http'. This behavior indicates the abuse of the Windows Registry Server utility to load a remote COM scriptlet, a technique frequently observed in TA505 adversary activity to execute malicious payloads, such as the Get2 downloader or SDBbot RAT.
Detects the use of PowerShell to download content from a remote URI and execute it using encoded commands or expression evaluation, a pattern commonly used by the FIN8 threat group (Syssphinx) to deploy the BADHATCH backdoor.
Detects the creation of scheduled tasks that invoke rundll32.exe to execute code from suspicious, user-writable, or temporary file paths. This pattern is consistent with common persistence mechanisms employed by threat groups such as Wizard Spider (also known as Grim Spider, Gold Blackburn, and Periwinkle Tempest) to execute payloads like TrickBot or BazarLoader.
Detects Microsoft Office applications (Winword/Excel) spawning PowerShell or MSHTA with base64-encoded command-line arguments, followed by subsequent persistence mechanisms such as creating scheduled tasks or modifying Registry Run keys. This behavior is indicative of APT38 (BlueNoroff) and similar campaigns delivering banking Trojans via malicious Office macros.
Detects the execution of potentially malicious processes mimicking cryptocurrency or wallet applications (e.g., 'wallet', 'coin', 'crypto', 'exchange') that are launched from user-accessible directories like Downloads or Temp. The detection specifically looks for these processes spawning command-line interpreters (cmd.exe, powershell.exe) or proxy execution binaries (rundll32.exe), a behavior pattern characteristic of the AppleJeus campaign associated with Lazarus Group (Diamond Sleet).
Detects the silent installation of common Remote Monitoring and Management (RMM) tools (ScreenConnect, Atera, AnyDesk) when triggered by potentially suspicious parent processes such as email clients, web browsers, or archive utilities. This pattern is characteristic of MuddyWater's (Mango Sandstorm) post-compromise tradecraft for establishing persistent C2 channels.
This rule detects instances where Microsoft Word (winword.exe) or Microsoft Excel (excel.exe) initiate a PowerShell (powershell.exe) process containing command-line arguments typical of downloader stagers, such as 'IEX', 'DownloadString', or hidden execution flags. This behavior is a common indicator of macro-based delivery of malware, frequently observed in campaigns associated with FIN7/Carbanak and other threat actors utilizing Cobalt Strike or similar offensive frameworks.
Detects lateral movement via PsExec (PSEXESVC) followed by mass file encryption/rename activities and the creation of ransom note files, characteristic of Wizard Spider's deployment of Conti ransomware.
Detects the execution of known Python scripts (CES_Enroll.py, ntlm_ces_relay.py, ces_negotiate_ntlm.py) often associated with NTLM relay attacks or forced authentication techniques. These scripts leverage Python to interact with authentication protocols or relay requests.
This rule performs a sweep across device file and process events to identify the execution or presence of files matching a curated list of 161 SHA256 hashes associated with twelve known malicious threat actors and families (Lynx, ANUBIS, Rhysida, LockBit, ALPHV/BlackCat, Qilin, Medusa, The Gentlemen, NetRunner, Genesis, Pay2Key, and Handala). The rule filters out events occurring in known EDR/AV quarantine or sandbox directory structures and dedupes hits on a per-device and per-hash basis within 24-hour windows to reduce alert noise.
Detects the Antino backdoor components (GatherOsState.exe or a standalone installer) spawning cmd.exe or powershell.exe to execute commands, indicative of command-and-control tasking.
Detects a suspicious sequence of events where a remote access tool (RAT) is installed on a device, followed by significantly elevated and anomalous database query activity performed by the same account over an extended period. The rule utilizes a baseline window to identify deviations from normal query volumes while excluding known service accounts and administrative ETL/BI tasks.
Detects a suspicious sequence of events where a remote access tool (RAT) is installed on a device, followed by significantly elevated and anomalous database query activity performed by the same account over an extended period. The rule utilizes a baseline window to identify deviations from normal query volumes while excluding known service accounts and administrative ETL/BI tasks.
Detects a suspicious sequence of events where a remote access tool (RAT) is installed on a device, followed by significantly elevated and anomalous database query activity performed by the same account over an extended period. The rule utilizes a baseline window to identify deviations from normal query volumes while excluding known service accounts and administrative ETL/BI tasks.
Page 47 of 976