Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of PowerShell with hidden window styles and encoded command arguments initiated directly from explorer.exe. This pattern is often indicative of malicious activity, such as fileless malware execution or obfuscated script delivery, where an attacker attempts to blend in with standard user interactions.
Detects the execution of PowerShell with hidden window styles and encoded command arguments initiated directly from explorer.exe. This pattern is often indicative of malicious activity, such as fileless malware execution or obfuscated script delivery, where an attacker attempts to blend in with standard user interactions.
Detects execution of PowerShell commands that exhibit characteristics frequently associated with malicious activity, such as reflective assembly loading, compression/decompression operations, use of specific known obfuscation markers, encoded commands, or execution originating from suspicious parent processes like explorer.exe or cmd.exe.
This rule detects a user account performing its first-ever GitHub OAuth or repository access within a short timeframe (30 minutes) after authenticating to a designated low-trust OpenAI community forum. This pattern is designed to identify potential adversary activity where a compromised or newly created account is used to pivot from a low-trust environment to corporate repository access.
This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.
Detects execution of command lines containing suspicious, potentially obfuscated substrings that do not correspond to standard Windows utilities. The use of custom delimiters like 'ASISFH' within common command strings suggests an attempt to bypass signature-based detection.
Detects a scenario where a process (cmd.exe) executing a file named 'config.bat' subsequently launches another instance of cmd.exe to delete files with a '.lnk' extension. This behavior is indicative of cleanup activities after potential malicious script execution.
Detects the execution of PowerShell with encoded commands in headless mode, associated with the Microsoft Edge Update Task (MicrosoftEdgeUpdateTaskUserS-1-5-24). This pattern is indicative of potential malicious activity where legitimate update tasks are abused to run obfuscated scripts.
Detects instances where the process 'UBPUpdater.Exe' spawns a process or command line utilizing 'UBPPatch.Psh'. The rule highlights that 'UBPPatch.Psh' is masquerading as a non-executable PowerShell script while likely operating as a malicious binary or PowerShell executable.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that masquerade as legitimate Microsoft Edge or OneDrive update tasks. This behavior is associated with APT36 (Transparent Tribe) and their use of modular malware to establish persistence.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
Detects the creation of hard links using 'mklink /H' targeting specific paths in ProgramData or linking to specific executable paths in AppData. This behavior is often indicative of adversaries attempting to perform file system manipulation for persistence, defense evasion, or masquerading.
Detects the execution of command-line operations that involve the deletion of shortcut (.lnk) files or the self-deletion of batch scripts, often used by malware or malicious scripts to minimize their footprint and remove evidence after execution.
Detects when an Azure account user creates a new Cognitive Services or Azure OpenAI resource, specifically when that user has no record of creating such resources in the previous 30 days. This behavior is often indicative of automated resource abuse, unauthorized infrastructure deployment, or attempts to leverage GPU/compute quotas in a newly compromised environment.
Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.
Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.
This rule detects a suspicious sequence of AWS CloudTrail events where a single identity performs a burst of discovery and enumeration activities (reconnaissance) followed shortly by requests to access sensitive secrets, credentials, or sensitive files (e.g., .env files). This pattern is indicative of an attacker who has gained initial access and is pivoting to identify and exfiltrate credentials.
Detects anomalous bursts of cloud secret or parameter retrieval API calls followed shortly by administrative actions that expose data or credentials (such as bucket policy changes or new key creation). This behavior is consistent with an adversary staging compromised credentials to exfiltrate data or maintain persistence.
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
Page 100 of 864