Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule watches for Node or similar runtimes scanning cloud secret stores after installing a dependency. Stolen secrets can lead to full cloud account takeover. Validate the package against your software bill of materials. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule looks for fake reverse-engineering or debugging tools installing clipboard monitors that swap cryptocurrency addresses. Developers are targeted because they handle valuable assets. Use official vendor downloads only. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects COR_PROFILER environment variable abuse for .NET DLL hijacking
Detects unauthorized access to Windows Credential Manager vault
Detects attempts to dump LSASS memory for credential extraction
Detects abuse of trusted MSP remote management tools for initial access
Detects modification of macOS re-opened applications list for persistence on login
Detects KernelCallbackTable manipulation for process injection via kernel callback
Detects reflective DLL loading technique that avoids writing files to disk
Detects LD_PRELOAD environment variable set to load malicious shared libraries
Detects in-memory archive creation using .NET compression libraries
Detects malware checking for user activity to detect sandbox environments
Detects processes ignoring termination signals to prevent shutdown
Detects ListPlanting injection using LVM_SORTITEMS and SendMessage API
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
Detects installation of malicious Exchange transport agents for email persistence
Detects SSH agent forwarding being abused for lateral movement
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Attempts to discover running processes on a Windows system using either native utilities or PowerShell commands/API calls. Adversaries often use these methods to gain information about running processes as part of discovery.
Hunting rule, not a drop in detection
Hunting rule, not a drop in detection
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Page 67 of 84