Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects process injection targeting a web browser process.
Amatera and comparable infostealers inject into trusted browser processes
such as Chrome, Edge, Brave and Firefox to evade detection and access
credential and cookie data in memory.
Amatera and comparable infostealers inject into trusted browser processes
such as Chrome, Edge, Brave and Firefox to evade detection and access
credential and cookie data in memory.
Detects the execution of Salat Stealer C2-pushed scripts involving the disabling of recovery environment via reagentc.exe and UAC disabling via registry modification on the same device within one hour.
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Detects process injection activities (such as remote thread creation, memory allocation, and writing to virtual memory) targeting common Windows background processes where the injecting process runs directly from the C:\Windows\ directory with a random or suspicious executable name.
Detects the correlation of Registry Run key values for known utilities (Lightshot, Procmon, RuntimeBroker) pointing to paths in Program Files with a scheduled task creation of the same name on the same device within a 1-hour window.
Detects execution of a Python script named SysMon.py via a scheduled task, correlated with a subsequent network connection to ipinfo.io initiated by the same Python interpreter within a 10-minute window.
Detects PowerShell registering a logon scheduled task that executes a Trays.exe binary from an AppData Yandex Trays path with the -tray argument, or a scheduled task specifically named 'Microsoft apdate'. Associated with the RareWolf AnyDesk dropper batch script.
Correlates a CVE-2026-76504 encoded /%6a_security_check login POST with a follow-on /dataservice/admin/user request from the same client to the same vManage within 10 minutes. Summarized and sorted by follow-on count.
Detects potential local privilege escalation (LPE) attempts leveraging the afd.sys vulnerability by correlating LPEClient or FudModule artifact creation, image loads, or process execution with subsequent afd.sys driver loading or exploit guard blocking events within a 60-minute window.
Detects malicious behaviors involving the Chisel tunneling tool, including reverse SOCKS proxy connections with TLS verification skipped, cron-based persistence referencing watchdog scripts in hidden /var/tmp directories, and associated tool staging activities.
Detects instances where rundll32.exe is executed with no arguments or minimal arguments, matching the typical Cobalt Strike spawn-to sacrificial process behavior. Aggregated per device, account, and parent process.
Detects the Yoba campaign behavior involving the staging of wmpdmc.exe along with wmpdui.dll or ampdui.dll in the ProgramData\WMProcess directory, followed by execution or invocation via scheduled tasks.
Detects persistence mechanisms associated with the trojanized anthropic.claude-code loader, including macOS LaunchAgent creation (com.apple.sysmond), Linux cron @reboot persistence using hidden config files (.smt), Windows scheduled tasks (SysMon SYSTEM task), and SSH authorized keys manipulation.
Detects a Run/RunOnce registry value whose data points to an
executable or script in a user-writable location (AppData, Temp, ProgramData,
Users\\Public). Amatera establishes persistence by adding Run key entries that
relaunch the stealer on user logon.
executable or script in a user-writable location (AppData, Temp, ProgramData,
Users\\Public). Amatera establishes persistence by adding Run key entries that
relaunch the stealer on user logon.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects administrative access to the DLP console from an unfamiliar address. Console
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
Identifies available cross-process memory and thread manipulation telemetry events in DeviceEvents, tracking actions such as remote thread creation, virtual memory allocation, and process hollowing indicators before constructing process injection correlations.
Detects Microsoft Entra ID sign-ins to specific third-party applications related to Updraft (TeamUpdraft, UpdraftCentral, UpdraftVault, UpdraftClone, UpdraftPlus) with anomalous characteristics such as multi-IP access, distinct countries, or failed-then-successful access attempts, indicating possible credential compromise or misuse.
Detects successful administrative login events originating from IP addresses outside of configured trusted management networks on Fortinet devices.
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Detects potential C2Agent parent-spoofing behavior characterized by short-lived scheduled tasks (created and deleted within a 10-minute window with names matching c2a_<n>) or process relaunches carrying specific -fork2 command-line markers.
Page 2 of 401