Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
KQL Query from file: Sentinel Alerts & MITRE ATT&CK Analysis
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
KQL Query
KQL Query from file: PowerShell Self-Pwn
KQL Query
KQL Query from file: Detecting Windows Downdate Abuse
Detects the execution of 'certutil.exe' with specific command-line flags ('urlcache' or 'verifyctl') used to download files from known file-sharing or content delivery websites. This technique is often leveraged by adversaries to transfer malicious tools or payloads into a compromised environment, bypassing traditional security controls.
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Detects base64 encoded .NET reflective loading of Assembly
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, characterized by the repeated use of characters like [], (), !, and +. This rule looks for the presence of multiple distinct characters from the core JSFireTruck set within web response bodies.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Detects PowerShell script blocks containing function definitions or .NET method calls commonly used by Cobalt Strike PowerShell loaders for dynamic API resolution, memory allocation, and shellcode execution. This rule is based on analysis from the provided reference.
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.
'Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware.'
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Page 67 of 81