Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Correlates CI/CD runners utilizing AWS credentials to execute secretsmanager:ListSecrets or GetSecretValue outside normal parameters. This rule detects processes named 'aws' executing commands related to AWS SecretsManager, specifically 'ListSecrets' or 'GetSecretValue'.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, especially when combined with a successful logon event for the same user.
This rule correlates the execution of the VS Code CLI ('code.exe') with the output redirection of a command prompt ('cmd.exe') to a temporary text file. This behavior is indicative of an attempt to scrape authentication codes, potentially for phishing or credential theft, specifically targeting the 'tunnel' functionality of VS Code.
Correlates the exploited Bomgar service gathering and compressing large amounts of internal data into an archive file prior to egress. This rule specifically looks for Bomgar processes initiating archive creation using common archiving utilities like tar, zip, or 7z, with the command line indicating the creation of a .zip or .tar.gz file.
Detects the post-encryption cleanup routine where Nightspire utilizes wevtutil to clear Security, System, and Application event logs to hinder incident response efforts. This rule specifically looks for the execution of 'wevtutil.exe' with the 'cl' (clear log) command targeting 'System', 'Security', or 'Application' event logs, and correlates it with the presence of files ending with '.nightspire' on the same device.
Correlates the recent download of an .rdp file with its execution by mstsc.exe, initiating the outbound connection to the attacker's infrastructure.
Detects the deletion of local shadow copies using vssadmin, WMI, PowerShell, or wbadmin, a common tactic employed by ransomware to prevent system recovery.
Detects processes associated with Remcos RAT attempting to perform activity logging or idle time monitoring by looking for specific command-line arguments related to window and idle state functions, combined with process names or command lines containing 'Remcos'.
Detects a user navigating to the Microsoft devicelogin portal immediately after clicking a link from an email, a precursor to Device Code OAuth phishing.
Detects a non-browser process reading active browser titles, URLs, or accessibility trees and matching Brazilian bank names before activating fraud modules. Specifically, it looks for processes named 'banana', 'client', 'update', or 'service' (case-insensitive) that are executing commands related to UI automation or window title retrieval, and simultaneously searching for banking-related keywords like 'bank', 'internet banking', 'agencia', or 'conta'.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
Detects the presence of debugger context strings indicative of Makop's loader exception triggering, specifically looking for '.cxr ' or 'dump context' in the process command line. This behavior is often associated with anti-analysis techniques used by malware like Makop Ransomware to detect and evade debugging environments.
Detects the automated scraping of Telegram/Teletype pages by scripts to resolve dynamic C2 IP addresses.
Detects curl.exe where system metadata is concatenated into User-Agent/Referer fields with specific delimiters.
Attempts to discover running processes on a Windows system using either native utilities or PowerShell commands/API calls. Adversaries often use these methods to gain information about running processes as part of discovery.
Hunting rule, not a drop in detection
Hunting rule, not a drop in detection
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Identifies bash scripts leveraging 'chmod +x' inside '/tmp' or '/Users/Shared' to make a downloaded Mach-O payload executable. This activity is associated with the Sapphire Sleet threat group.
Detects commands exporting all environment variables (env, set, printenv) to a file, often used to steal CI/CD secrets on developer workstations. The rule specifically looks for these commands being executed by common scripting/execution environments like node.exe, python.exe, bash, or cmd.exe.
Detects the Yuta/Glove Stealer malware (winupdate.exe) performing environment checks by querying Windows registry keys associated with virtualization software (VMware, VirtualBox, QEMU). This behavior is indicative of sandbox evasion techniques used to detect analysis environments before executing secondary payloads.
Detects instances where critical Windows host processes (svchost.exe, explorer.exe, or lsass.exe) spawn a new process, which is a common behavioral indicator of process injection or post-exploitation activity. The rule excludes common, legitimate system-level causality chains.
Page 44 of 84