Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
Detects the execution of known Windows privilege escalation tools commonly referred to as 'potato' exploits (e.g., JuicyPotato, SweetPotato, PrintSpoofer). These tools typically exploit service account misconfigurations or Windows APIs to achieve local privilege escalation to SYSTEM.
This rule monitors for processes running from a specific directory under 'AppData\Roaming\traiolx custom utils\' that load critical Windows system libraries ('user32.dll' or 'kernel32.dll'). This behavior is indicative of DLL side-loading or masquerading where an executable in a non-standard, user-writable directory attempts to load core system components, a common tactic used by malware to establish persistence or run malicious code.
This rule detects when known DLL files (7z.dll or normaliz.dll) are loaded by a process from a file path containing 'Traiolx Custom Utils'. This pattern is often indicative of DLL side-loading or hijacking, where an adversary places malicious or proxy DLLs in a custom directory to be loaded by a legitimate application.
Detects instances where the svchost.exe process is associated with multiple occurrences of indicators categorized as 'Misc', potentially indicating malicious activity or process abuse that bypasses standard detection signatures.
This rule detects potentially malicious activities involving Microsoft Copilot and Microsoft Graph, specifically focusing on unauthorized mailbox access via non-interactive sessions and patterns indicative of Server-Side Request Forgery (SSRF) during search operations. It monitors for anomalous interaction with the Graph API, specific Copilot search parameters, and suspicious image search requests.
Detects the creation of scheduled tasks using the 'schtasks' utility, initiated by suspicious parent processes (browsers, scripting engines, or common tools) or utilizing suspicious task actions (PowerShell, VBScript, etc.) in user-writable directories. Additionally, it flags tasks with high-frequency scheduling or persistence triggers paired with encoded or hidden command-line arguments, which are common indicators of malicious activity such as malware execution or persistence mechanisms.
Detects the execution of LuaJit.exe with a config.ini script, which acts as a Lua-based shellcode loader for BeepRAT. The loader uses Lua FFI to call Windows APIs such as VirtualAlloc and CreateThread to execute shellcode stored in temp.bin directly in memory. This pattern is indicative of fileless execution techniques employed by the BeepRAT remote access trojan.
Detects the creation of specific vulnerable driver files abused by Gentlemen RaaS EDR killers. Gentlemen operators rapidly deploy new BYOVD proofs-of-concept to evade and disable host defenses by dropping known vulnerable drivers to disk.
This rule detects network connections to port 389 (LDAP) that contain specific keywords related to Active Directory trust relationships. This could indicate an adversary attempting to discover trust details within an Active Directory environment.
Detects potential local privilege escalation (LPE) attempts targeting the AnyDesk adprinterpipe named pipe. The rule monitors for the execution of known malicious indicators, unauthorized access to the adprinterpipe, AnyDesk spawning unexpected processes as SYSTEM, and the creation of services by AnyDesk child processes.
Detects a post-compromise reconnaissance burst associated with BeepRAT, where a process running from a suspicious directory (AppData, Temp, or ProgramData) executes five or more system discovery commands within a 60-second window, following the creation of a scheduled task on the same host.
Detects the BeepRAT malware using the Tiny C Compiler (tcc.exe) to execute shellcode directly from memory. The rule identifies TCC execution from non-standard directories (specifically within %LOCALAPPDATA%\TCC) using specific flags (-nostdlib -run), and correlates this activity with the creation of an elevated scheduled task named 'WindowsUpdateTempFileCleanUp' used for persistence.
Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.
This rule detects the creation of scheduled tasks or registry run keys that contain suspicious path indicators or specific file names often associated with persistence mechanisms. It monitors for the use of 'schtasks.exe' or 'at.exe' to create tasks referencing paths like ProgramData, Temp, AppData, or IDM\logs, as well as modifications to the 'Run' registry key with similar suspicious values.
Detects the creation of scheduled tasks using schtasks.exe that involve paths associated with staging (ProgramData, Temp, AppData) or are spawned by suspicious processes like Solid PDF Creator or MediumInstStart. This behavior is indicative of ransomware implant staging or persistence mechanisms used by threat actors.
Detects indicators of Mustang Panda activity, specifically identifying the loading of known malicious side-loaded DLLs (SolidPDFCreator.dll, ctxmui.dll) or anomalous process behavior originating from staging directories (e.g., \ProgramData\IDM\logs\) and binaries (MediumInstStart.exe, pct2bmp.exe) that interact with common system or browser processes.
Detects suspicious app installations, custom app creation, and bot additions within Microsoft Teams. This rule identifies activities such as sideloaded app installations, which can bypass standard vetting processes and serve as a persistence mechanism for attackers. It also flags custom app creation outside of typical development teams, which could indicate the deployment of command and control (C2) bots or data exfiltration applications. Additionally, the rule looks for the addition of bots to teams and suspicious keywords in app names that might suggest impersonation or malicious tooling.
Slack Anomalous Activity Detected
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that could indicate a compromised account or unauthorized access to a Slack workspace.
Slack Anomalous Activity Detected
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that could indicate a compromised account or unauthorized access to a Slack workspace.
Detects the creation or modification of suspicious Launch Agent or Launch Daemon .plist files, or a hidden application support directory, masquerading as 'com.apple.accountsd' on macOS. This behavior is often indicative of persistence mechanisms used by adversaries.
Page 86 of 401