Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule monitors for credential dumping activities by identifying the execution of Mimikatz, the use of command-line arguments specific to Mimikatz (e.g., 'sekurlsa'), or unauthorized processes attempting to access the Local Security Authority Subsystem Service (LSASS) process.
Detects SSH client processes linked to libssh2 (such as ssh, curl, sftp, scp) exhibiting sustained high CPU usage (>=95%) for more than 60 seconds while maintaining an active outbound SSH connection. This behavior is consistent with the denial-of-service vulnerability CVE-2026-55199, where an attacker-controlled SSH server provides an excessively large extension count during the key exchange process, triggering an infinite loop within the libssh2 library.
Detects process-related activities involving specific 'XGU::Feature' command line arguments, commonly associated with token manipulation, credential theft, or lateral movement attempts. This rule monitors process creation, cross-process access, and module loading to identify potentially malicious interactions with Windows security tokens.
Detects unexpected crashes of critical macOS system processes such as sharingd, nsurlsessiond, airplayd, AirPlayXPCHelper, and NetAuthSysAgent. Frequent crashing of these components can indicate instability or potentially malicious attempts to interfere with system services.
Detects the creation of power management assertions using the IOPMAssertionCreateWithName API by processes other than standard system binaries. Attackers may use this technique to prevent a system from sleeping, which can be leveraged to maintain persistence or ensure that malicious background activities continue without interruption.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
This rule monitors for Cobalt Strike Beacon named pipe C2 patterns by analyzing Sysmon event IDs 17 (Pipe Created) and 18 (Pipe Connected). It specifically flags known default Cobalt Strike pipe naming conventions (e.g., 'MSSE-', 'postex_ssh_', 'msagent_') and common randomized short alphanumeric pipe names while excluding legitimate Windows system pipes.
Detects cross-process injection attempts into the Windows system process 'svchost.exe' where the source process is either unsigned or lacks a verified Microsoft publisher. This pattern is commonly observed in malware payloads, such as DcRAT, attempting to hide malicious activity within a legitimate system process.
Detects suspicious process activity, module loading, and function calls indicative of the BeepRAT malware family. The rule monitors for keyboard hooking via SetWindowsHookEx, the presence of specific keylogger-related command-line arguments, and the execution or loading of files associated with BeepRAT lure binaries.
Detects the deployment and activity of the Remcos Remote Access Trojan (RAT) as part of the BQTLock (BaqiyatLock) attack chain. This rule monitors for process injection into critical Windows processes, malicious Run key persistence entries, non-standard outbound TLS communication from non-browser processes, and the creation of potential keylogging artifacts in the AppData directory.
Detects the creation of a potentially malicious shared library (libcache.so) in /usr/local/lib followed by a modification of the /etc/ld.so.preload file on Linux systems within a short time frame. This technique is commonly used for persistence and code injection, where the dynamic linker is forced to load the malicious library before others.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Detects unexpected crashes of critical macOS system processes such as sharingd, nsurlsessiond, airplayd, AirPlayXPCHelper, and NetAuthSysAgent. Frequent crashing of these components can indicate instability or potentially malicious attempts to interfere with system services.
This rule monitors for file and process events associated with known malicious Chrome extensions. It filters for specific extension IDs embedded within file paths or command-line strings, which typically indicate the installation or activity of malicious browser plugins.
Detects DLL side-loading where the signed Tencent UxEnhanceHost binary loads a malicious UxEnhance64.dll from randomized staging directories under C:\Users\Public\, a primary execution vehicle in the SilverFox campaign.
Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.
This rule detects common Windows processes (msiexec, cmd, dllhost, or rundll32) attempting to detect the presence of a debugger by calling 'IsDebuggerPresent' or 'SetUnhandledExceptionFilter' within their call stack. This behavior is often associated with malware or malicious tools attempting to evade dynamic analysis in sandbox or debugged environments.
This rule detects activity associated with the SHARDLOADER malware loader. It monitors for the presence of specific DLL files ('SolidPDFCreator.dll' or 'MediumInstStart.exe') in process image paths or process names, and explicitly checks for the creation of a unique mutex artifact named 'uydgcfteionxcfd' as a high-confidence indicator of execution.
Detects the execution of known system binary names (e.g., svchost.exe, MsEdgeUpdate.exe) from suspicious locations within the user AppData directory rather than the standard Windows System32 directory. This behavior is a common indicator of malware persistence, masquerading, or defensive evasion.
Page 34 of 84