Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
165
46
37
9
9
Contributors
60
46
36
25
20
Categories
101
78
76
66
59
Platforms
144
61
58
22
17
Products / Services
81
66
44
38
32
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
3
1
IDS Classtypes
34
7
4
1
IDS Protocols
38
5
1
1
This query helps reviewing Phish detections done by some of the most frequent detection technologies in the last 7 days
This query helps reviewing malware detections by detection methods
Detects the initial execution pattern of the APT41 TOUGHPROGRESS malware via a malicious LNK file executing rundll32.exe with a specific command line argument as described in the Google Cloud blog.
This rule detects when a user bypasses Chrome Safe Browsing warnings for potentially dangerous content or downloads. It specifically looks for events where Chrome Management reports a bad navigation event, dangerous download event, content transfer event, or unscanned file event, and the security result indicates the event was 'BYPASSED' by the user. The rule also assigns a risk score based on the category of the bypassed threat, with higher scores for malware, dangerous hosts, and social engineering.
Detects the execution of PowerShell commands embedded within a link (.lnk) file. This rule specifically looks for instances where 'explorer.exe' launches 'cmd.exe', and the command line of 'cmd.exe' contains both 'powershell' and '.lnk', indicating an attempt to execute PowerShell via a shortcut file.
Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.
Symlink Etc Passwd
Sigma
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Page 14 of 14