Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15,640 detections
Filters
Last updated
All Time
Detection languages
6,585
4,571
999
788
723
Contributors
3,615
2,087
2,043
1,738
1,271
Categories
9,466
6,780
3,295
2,507
1,598
Platforms
13,083
2,283
1,184
493
255
Products / Services
3,812
3,375
1,975
1,254
705
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
22
21
20
19
19
IDS Classtypes
175
58
53
25
11
IDS Protocols
256
53
17
8
4
This rule detects the remote installation of a new systemd service unit. It specifically looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "/etc/systemd/system/" and ".service" (case-insensitive). This combination suggests that a new systemd service file is being transferred or created remotely, which could indicate an attacker establishing persistence or escalating privileges.
This rule detects attempts to access named pipes via Server Message Block (SMB) on port 445. It specifically looks for the SMB signature and the 'IPC$' string within the traffic, indicating an attempt to establish an Inter-Process Communication (IPC) connection. A threshold is set to trigger an alert if 10 such events occur from the same source within 30 seconds, which could indicate enumeration or exploitation attempts.
This rule detects attempts to download executable files disguised as common media file types (MP4, MP3, AVI, MOV) over HTTP. It specifically looks for the 'MZ' header, which indicates a Windows executable, within the first two bytes of the file data, combined with a URI ending in a media file extension. This technique is often used by attackers to bypass security controls and trick users into executing malicious payloads.
WScript Execution From ADS
Cortex XDR
Detects wscript.exe or cscript.exe executing a script from an Alternate Data Stream (ADS) path, specifically within the Users directory, as indicated by a colon without a preceding drive letter context. This behavior is known to be used by malware like GammaWorm for persistence by executing hidden VBScript payloads.
Detects enumeration of USB devices for peripheral device discovery
Detects the creation or execution of the SSH propagation payload script (.sshu-setup.js), used by the Hades stealer to propagate via SSH from compromised workstations. This rule identifies file creation/modification/renaming events for the specific script name, or process creation events where the command line references the script.
This rule detects a high frequency of process creations (Event ID 4688) with command-line arguments containing keywords indicative of software publishing or deployment, such as 'publish', 'deploy', 'artifact', or 'release'. A count of 3 or more such events within a one-hour window from the same computer and account is considered suspicious. This pattern could indicate legitimate CI/CD activities, but also potential abuse of software deployment tools or a software supply chain compromise by an adversary.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
This rule detects an unusually high number of command-line executions containing keywords related to 'dependency' or 'library' and 'update' or 'upgrade' within a one-hour window on a single computer. This behavior could indicate an adversary attempting to modify system components, install malicious libraries, or compromise the software supply chain by frequently updating or upgrading software dependencies.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
This rule detects potential path traversal attempts against an IIS web server by looking for sequences like '../' or '..\\' in the URI query string. It triggers an alert if five or more such attempts are observed from a single IP address within an hour, indicating a possible malicious scanning or exploitation attempt.
Detects multiple attempts at command injection through IIS web server URI queries. The rule looks for common command execution functions like 'eval(', 'system(', or 'exec(' within the 'csUriQuery' field of W3C IIS logs. A threshold of 3 or more attempts from the same IP within an hour triggers the alert.
This rule detects suspicious activity where 'cmd.exe' or 'powershell.exe' are launched from 'explorer.exe' or 'taskmgr.exe' with a high frequency (3 or more times within an hour) by the same user on the same computer. This pattern can indicate an attacker attempting to gain command-line access or execute scripts after initial access, potentially bypassing direct execution from malicious processes.
This rule detects suspicious activity indicative of post-quantum ransomware, combining two main indicators: the execution of processes with command-line arguments related to post-quantum cryptographic algorithms (Kyber, ML-KEM, NTRU, Dilithium, Falcon, SPHINCS) and the creation of common ransomware notes (README.txt, DECRYPT.txt, RESTORE.txt, PAYMENT.txt, RANSOM.txt). The cryptographic operation detection specifically looks for high or system integrity processes and excludes common legitimate cryptographic tools. The rule correlates multiple cryptographic operations within a short timeframe and the creation of ransom notes to identify potential ransomware deployment.
Detects the execution of the zenity dialog tool spawned by unusual parents (like IDEs or bash scripts) to create fake password prompts on Linux. The Linux variant of UNK_DeadDrop utilizes this to trick developers into providing their system passwords, enabling root access and GNOME Keyring extraction.
Detects the Intune Management Extension agent launching command shells or system utilities. Because Intune executes scripts as SYSTEM, detecting this behavior on the endpoint is critical for identifying malicious script deployments.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts
This rule detects attempts to execute commands via an unauthenticated Docker API. Specifically, it looks for HTTP POST requests to the '/exec' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker daemon access. This could indicate an attacker attempting to gain control or execute arbitrary commands within Docker containers or the host system.
This rule detects attempts to exploit the Heartbleed vulnerability (CVE-2014-0160) by identifying a specific pattern in TLS heartbeat requests. It looks for a TLS heartbeat request with a type of 0x18 (heartbeat request) and a length greater than 3 bytes, which is indicative of an oversized heartbeat request used in the Heartbleed exploit.
Page 476 of 745