Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects in-memory modification of the AmsiScanBuffer function within PowerShell processes, specifically targeting the injection of patch instructions (e.g., MOV EAX, 80070057; RET). This technique is characteristic of .NET loaders like PIVOTPIPE attempting to bypass Antimalware Scan Interface (AMSI) inspection before executing malicious payloads.
Detects the GHAPPIER four-stage malware loader, specifically targeting npm-based JavaScript files. The rule identifies malicious activity through specific artifacts including hardcoded C2 URLs (vercel.app domains), campaign markers, file paths, and eval-based execution patterns.
Detects the loading of amsi.dll by common .NET loader processes, which may indicate attempts to patch or bypass the Antimalware Scan Interface (AMSI) in memory. The rule monitors for image load events of amsi.dll and correlates them with process creation events of known loaders such as powershell.exe, rundll32.exe, and others.
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the GHAPPIER loader identified across 65 public npm/GitHub repositories and 22 developer accounts, based on its embedded remote-fetch/eval pattern and campaign markers
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the execution of a specific batch file named 'KB85809588.bat', either directly or via the Windows Command Shell (cmd.exe) and Console Host (conhost.exe). This pattern is often indicative of malicious scripts or automated tasks executed as part of an attack chain.
This rule monitors for suspicious Node.js process activity, specifically focusing on the loading of scripts associated with obfuscated or malicious packages (e.g., sharedLoad.min.js, indexed-btree) and the use of child_process spawn patterns that indicate detached, hidden, or unreferenced child processes, which are common tactics for bypassing detection or maintaining stealthy execution.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
This rule monitors process creation events for common command-line obfuscation patterns used to evade detection. It flags suspicious usage of encoding (e.g., base64), character manipulation (e.g., caret char insertion, case randomization), and scripting-related concatenation or dynamic reassembly techniques within cmd, powershell, or script host commands.
Detects potential device-code phishing abuse where a successful device code authentication is followed by scripted API activity using common automation user agents within a short time window (10 minutes). This behavior is indicative of an attacker who has successfully phished a user's device code and is immediately leveraging the stolen token to interact with Microsoft Graph, Azure, or Intune services.
Detects the creation of .lnk files within the user startup directory. The rule flags suspicious activity by monitoring for specific file names often associated with the StealC information stealer, or when these files are created by common scripting hosts like PowerShell, WScript, or CScript.
Page 34 of 191