Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects modifications to Registry Run or RunOnce keys that include references to 'ManageEngine' or 'SystemOptimizer' and attempt to execute scripting hosts like wscript, cscript, powershell, or cmd. This behavior is indicative of persistence mechanisms often used by adversaries.
Detects Vidar Stealer using NtQueueApcThreadEx2 with QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC to immediately execute CryptUnprotectMemory in a live browser thread for ABE v20_master_key extraction, preceded by thread enumeration via CreateToolhelp32Snapshot, Thread32First/Next, and NtOpenThread.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Detects regsvr32.exe loading DLLs from user-writable directories such as Temp, AppData, ProgramData, Downloads, Desktop, and Public. Legitimate DLL registration runs from System32 or Program Files - execution from these paths indicates LOLBin abuse for proxy execution, DLL sideloading, or defense evasion commonly used to launch malware payloads.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects a specific persistence mechanism where a scheduled task named 'TPMProfiler' is used to run QEMU, establishing an SSH backdoor. This technique was identified by Huntress in post-exploitation activity related to SolarWinds WHD exploitation.
Detects potential persistence attempts on Windows systems where an unsigned executable, located in a user-writable directory (Temp, AppData, Downloads), is either configured for automatic startup via Registry run keys or registered as a scheduled task.
Modular remote access trojan associated with long-term espionage intrusions
Loader used in click-hijacking traffic distribution scheme
USB worm and loader leveraging living-off-the-land binaries
Infostealer distributed via fake open-source tool impersonation sites
Infostealer distributed via fake open-source tool impersonation sites
Loader used in click-hijacking traffic distribution scheme
Malvertising loader delivering CastleStealer via malicious Google Ads
Infostealer-as-a-service targeting browser credentials and crypto wallets
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Lightweight remote access trojan deployed in recruiter-themed social engineering
High-velocity ransomware-as-a-service with aggressive leak-site extortion
IoT botnet malware family used for DDoS and proxy infrastructure
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lightweight remote access trojan deployed in recruiter-themed social engineering
Page 103 of 401