Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects suspicious activity indicative of post-quantum ransomware, combining two main indicators: the execution of processes with command-line arguments related to post-quantum cryptographic algorithms (Kyber, ML-KEM, NTRU, Dilithium, Falcon, SPHINCS) and the creation of common ransomware notes (README.txt, DECRYPT.txt, RESTORE.txt, PAYMENT.txt, RANSOM.txt). The cryptographic operation detection specifically looks for high or system integrity processes and excludes common legitimate cryptographic tools. The rule correlates multiple cryptographic operations within a short timeframe and the creation of ransom notes to identify potential ransomware deployment.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Detects suspicious execution or persistence artifacts in /etc/rc.d/ or /usr/local/libexec/ipsec/ on edge firewalls, specifically indicating VerdantBamboo's BRICKSTORM malware on pfSense appliances. The rule looks for process command lines or folder paths containing "/usr/local/libexec/ipsec/blacklist" or modifications to "/etc/rc.d/cron" that include "blacklist".
Detects the specific threat string used by the Miasma/Shai-Hulud malware variant to wipe systems if a stolen token is revoked. This rule looks for the highly unique string 'IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner' within process command lines.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects processes attempting to scrape unmasked CI runner secrets from memory, specifically looking for techniques used by the Miasma worm to bypass GitHub Actions secret masking. This rule identifies suspicious command-line patterns indicative of secret extraction, such as searching for 'isSecret' or accessing '/proc/mem' with Python.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
This rule detects the execution of 'net.exe' or 'net1.exe' with the command line containing 'time /domain' within 10 minutes after 'quickassist.exe' has been executed. This behavior can indicate an adversary performing system time discovery or domain reconnaissance after gaining initial access or establishing remote access via Quick Assist.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
Detects instances of the Tor daemon executing with custom torrc configurations outside of the standard Tor Browser directory. This behavior is often associated with malware like IronWorm, which downloads the Tor expert bundle, writes its own torrc, and starts the daemon to tunnel C2 traffic.
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This technique is used by the SStar Agent RAT for its remote 'type' functionality.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
This rule detects various activities associated with the Nimbus Manticore implant, including its process execution with a specific argument, the creation of a scheduled task for persistence, and the staging of malicious files in a specific AppData directory. It looks for the execution of 'setup.exe' with 'doit' argument, the creation of a scheduled task containing 'BackupCheck', and the creation of specific files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' folder.
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
Detects regedit.exe being used to import a registry (.reg) file located in the C:\ProgramData\ directory. This technique is utilized in the Nimbus RAT attack chain, where users are socially engineered via Teams to manually import a pre-staged .reg file (e.g., InboxCorePro.reg) to establish persistence on the host.
AppArmor Profile Removed
Cortex XDR
This rule detects attempts to remove AppArmor profiles. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
Page 69 of 84