Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects the execution of a Windows Shortcut File (.lnk) that is masquerading as an image file. This technique is used by threat actors like APT29 to trick users into executing malicious code, often delivered within an ISO or ZIP file.
Mustang Panda conducted a phishing campaign against Myanmar entities using a compromised embassy email. The lure involved a PDF with an embedded URL that delivered a ZIP archive containing a trojanized executable and malicious DLL. The malware disguised itself as a PDF, sideloaded the DLL, established persistence, and executed further payloads. It performed system reconnaissance, data exfiltration via SFTP, and defense evasion.
This analytic detects network connections initiated by binaries that are not typically associated with network communication, such as 'notepad.exe', 'calc.exe' or 'write.exe'. It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information. These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller. Once the attack is done, attacker will rollback the sAMAccountName to its original name.
Detects scenarios where an attacker would abuse some privileges while realying host credentials to escalate privileges.
Detects scenarios where SearchIndexer spwaned another process with the same name, or when SearchIndexer process exists in an unexpected directory.
No description available.
This rule detects the execution of any process that originates from the '/tmp/' directory on a Linux system. The '/tmp/' directory is often used by adversaries to stage and execute malicious payloads, as it is typically writable by all users and can be used to bypass certain security controls. The rule specifically excludes executions of '/usr/bin/nextcloud' from '/tmp/' to reduce false positives.
Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost". This technique can be used for defense evasion by obscuring the true parent process.
This rule detects the creation of JavaScript files in the `AppData\Local\Temp` directory with a specific naming convention that resembles a GUID followed by a short alphanumeric e.g. or string and the '.js' eb2262cf-d737-4d55-9b98-84324ade4763ro.js.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This rule detects network connections and DNS queries to domains impersonating legitimate services, which are known to be used in the Epsilon Red ransomware campaign to deliver malicious HTA files.
Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.
Detects the creation of a randomly named executable (16-character alphanumeric) in common temporary directories (AppData\Local\Temp or C:\Windows\Temp). This behavior is associated with Warlock Dark Army ransomware.
This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.
Detects the creation of a directory with a trailing space in its name (e.g., "C:\Windows \") using the NT path prefix `\\?\`. This technique was observed in a Remcos malware campaign in June 2025 to masquerade as a legitimate system directory like `C:\Windows\SysWOW64` to evade detection.
Generic rule content from file: Masquerade - Suspicious ScreenConnect Install
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
KQL Query
KQL Query from file: Detecting Windows Downdate Abuse
Detects suspicious child processes spawned by wermgr.exe (Windows Error Reporting manager). Adversaries may abuse wermgr.exe to execute arbitrary commands or scripts, often as a method of defense evasion or privilege escalation. The rule specifically looks for common command-line utilities and scripting engines being launched as children of wermgr.exe, while filtering out known legitimate rundll32.exe activity related to WerConCpl.dll.
Page 34 of 40