Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects instances where the RemoteApp Gateway broker process (wkspbroker.exe) loads the 'radcui.dll' module from the 'AppData\Local\Microsoft\RemoteApp\Gateway' directory. This behavior, especially when accompanied by configuration artifacts like 'config.json' or 'comsrv.dat' in the same path, is indicative of potential DLL side-loading or application hijacking, as these components are typically expected to reside in system-protected directories rather than user-writable local paths.
Detects sign-ins to Office Home or Office365 applications from unmanaged or unknown devices, followed by an unusual amount or variety of activity within SharePoint Online or OneDrive for Business within a two-hour window. This behavior is indicative of potential unauthorized access or account compromise where an actor is using a non-corporate device to interact with sensitive cloud documents.
Detects the loading of radcui.dll by the WkspBroker.exe process when the DLL is located within a path associated with Microsoft RemoteApp Gateway, which is often indicative of DLL sideloading or execution hijacking of a legitimate process.
Detects the presence of a hardcoded X25519 public key associated with the 'indexed-btree' npm malware loader. This loader uses the key for ECDH key derivation to decrypt secondary payloads retrieved from an Ethereum smart contract, a technique used by malicious packages to hide their functionality.
Detects the execution of 'wkspbroker.exe' or the loading of 'radcui.dll' from a non-standard, user-writable directory path ('AppData\Local\Microsoft\RemoteApp\Gateway'). This behavior is indicative of DLL sideloading or execution of potentially malicious or unauthorized binaries masquerading as legitimate Windows remote connectivity components.
This rule monitors process creation events for common command-line obfuscation patterns used to evade detection. It flags suspicious usage of encoding (e.g., base64), character manipulation (e.g., caret char insertion, case randomization), and scripting-related concatenation or dynamic reassembly techniques within cmd, powershell, or script host commands.
Detects potential device-code phishing abuse where a successful device code authentication is followed by scripted API activity using common automation user agents within a short time window (10 minutes). This behavior is indicative of an attacker who has successfully phished a user's device code and is immediately leveraging the stolen token to interact with Microsoft Graph, Azure, or Intune services.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects instances where Windows Explorer (explorer.exe) spawns PowerShell with heavily obfuscated command lines, characterized by caret-obfuscation and execution policy bypass flags. This pattern is characteristic of ClickFix social engineering, where a user is tricked into pasting malicious commands into the Windows Run dialog.
Detects anomalous usage patterns for AI-platform API keys consistent with account takeover, specifically identifying concurrent multi-geographic access and the exercise of elevated administrative, write, or model-registry scopes within a short timeframe.
Detects execution of PowerShell commands that exhibit characteristics frequently associated with malicious activity, such as reflective assembly loading, compression/decompression operations, use of specific known obfuscation markers, encoded commands, or execution originating from suspicious parent processes like explorer.exe or cmd.exe.
Detects instances where explorer.exe initiates cmd.exe with suspicious command-line patterns often associated with malicious script execution or evasion. These include caret-based obfuscation, mixed-case PowerShell invocations, or base64-like blobs, alongside indicators of common malicious file paths or execution policy bypass flags.
Detects instances where explorer.exe initiates cmd.exe with suspicious command-line patterns often associated with malicious script execution or evasion. These include caret-based obfuscation, mixed-case PowerShell invocations, or base64-like blobs, alongside indicators of common malicious file paths or execution policy bypass flags.
Detects the creation or modification of inbox rules (e.g., forwarding, redirecting, deleting, or moving to hidden folders) that target finance, invoice, or payment-related communications, occurring shortly after an initial user sign-in from a new or unseen country/ASN within the last 30 days. This pattern is indicative of a post-compromise activity where an adversary attempts to exfiltrate financial data or hide malicious email activity.
Detects instances where a user account modifies security information, registers a new MFA method, or resets a password shortly after a successful sign-in from a country not observed for that user within the previous 30 days. This pattern is indicative of potential account takeover where an adversary adds persistence or MFA bypass methods to a newly compromised account.
This rule detects mass phishing campaigns by identifying HTML/HTM email attachments that contain embedded URLs. It monitors for a pattern where the same sender distributes these attachments to multiple recipients, a common behavior for HTML smuggling delivery vectors where malicious payloads are constructed client-side to bypass static email gateway inspection.
This rule monitors for potential MeshAgent activity associated with the Settra threat actor. It identifies processes that are likely renamed instances of MeshAgent (via metadata inspection), processes attempting to communicate with known C2 IP addresses, and direct network connections to these C2 IP addresses.
Detects the obfuscated first-stage JavaScript payload sharedLoad.min.js dropped by the malicious npm indexed-btree package, identified by string-array encoding and self-checksumming array rotation obfuscation patterns
Detects the sharedLoad.min.js obfuscated first-stage loader dropped by the malicious npm indexed-btree package, triggered via BTree.prototype.set to evade static/taint-analysis scanners
This rule detects potential prompt injection attacks against internal AI-powered assistants, agents, or LLM gateways. It monitors network HTTP requests for common patterns used to override system instructions, bypass safety filters, or force the model to adopt a privileged, unauthorized persona (e.g., administrator or debug mode). These techniques are often used in social engineering to manipulate the AI's output or security posture.
Page 106 of 864