Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects a suspicious sequence of events where a user engagement (voice/video call) involving themes of urgency or helpdesk interaction is closely followed by a high-risk administrative action (e.g., password reset, MFA device enrollment, or financial transfer) by the same user, where the communication session context differs from standard activity, indicative of a deepfake-enabled vishing attack.
Detects a suspicious sequence where an account undergoes a help-desk-initiated password or credential reset, followed shortly (within 30 minutes) by the registration of a new multi-factor authentication (MFA) device for that same account. This pattern is characteristic of social engineering attacks, such as those used by UNC3944/Scattered Spider, where an adversary impersonates a user to gain initial access and subsequently establishes persistence by adding an MFA device they control.
Detects the Sauron Loader DLL side-loading chain: rnpkeys.exe (legitimate) side-loading malicious rnp.dll, which loads tdwp.dll to decrypt the loader in memory, all staged from C:\ProgramData\keyroll. Requires BOTH DLLs to be loaded by the same rnpkeys.exe process instance (not either/or) to eliminate single-artifact false positives, and surfaces SHA256 hashes of all three components for direct comparison against known IOCs (legitimate rnpkeys.exe: 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991; malicious rnp.dll: 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8; malicious tdwp.dll: 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7).
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
This rule monitors for the creation or modification of inbox rules in Microsoft 365 that contain financial-related keywords (e.g., 'payment', 'wire', 'invoice') and disruptive actions such as deleting, moving, forwarding, or redirecting messages. These patterns are characteristic of Business Email Compromise (BEC) attacks, where adversaries attempt to conceal financial correspondence from the victim to facilitate fraudulent transactions.
Detects suspicious PE files that masquerade as Mozilla Firefox by using Firefox-related product names and metadata, but lack valid Mozilla Corporation code-signing signatures and are located within the ProgramData directory.
Detects the loading or execution of known SloppyRAT DLL samples. This malware is identified for its implementation of Hell's Gate-style indirect syscalls, utilizing techniques such as DJB2 API hashing and NTDLL stub parsing to evade EDR hooks. The rule monitors for specific file hashes and potential masquerading behaviors (e.g., hostfxr.dll) across image loading, file, and process events.
Detects a malicious browser helper DLL (Rapuncel) that attempts to inject into web browsers like Chrome and Edge. The rule identifies code that interacts with the browser's Elevation Service 'DecryptData' method, a technique used to bypass app-bound encryption, potentially to extract sensitive information like stored credentials.
This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.
Detects techniques used by SloppyRAT, including indirect NTDLL syscalls bypassing API hooks (Hell's Gate style), and the use of DJB2 API hashing for NtAllocateVirtualMemory and NtCreateThreadEx. It monitors for CallTrace patterns indicating unbacked memory calls into ntdll.dll, detection of hardcoded DJB2 hash constants, or the presence of the B8 (mov eax, imm32) instruction followed by the 0F 05 syscall opcode.
Detects the creation of email mailbox or transport rules that perform actions like hiding, deleting, marking as read, forwarding, or redirecting emails with finance or payment-related keywords. This behavior is indicative of a Business Email Compromise (BEC) post-exploitation workflow where adversaries attempt to conceal malicious activity or divert financial communications.
Detects the creation of a file on the system that matches a known malicious SHA256 hash.
Detects the use of PowerShell to reflectively load .NET assemblies into memory, often associated with fileless malware execution. The rule monitors for common reflection-based methods (e.g., Assembly.Load, [System.Reflection.Assembly]) in conjunction with encoded command patterns or script execution.
Detects specific administrative actions within Entra ID/Azure AD, including directory role assignments, password resets, and account enablement/disablement. This rule monitors for sensitive identity lifecycle and privilege management events that, if performed by unauthorized actors or in an unexpected context, could indicate account compromise, persistence, or privilege escalation.
Detects anomalous sign-in patterns indicative of real-time MFA relay attacks, where a user principal authenticates successfully from multiple distinct IP addresses and geographical locations within a short time window (15 minutes), suggesting the active interception of credentials and MFA challenges by a Phishing-as-a-Service platform.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects potential SectopRAT loader activity by identifying non-.NET-native processes accessing 'pool.db' in the ProgramData directory followed by the immediate loading of .NET CLR libraries (clr.dll or mscoreei.dll). This pattern is indicative of reflective loading of a decrypted .NET payload into memory within a target process.
Detects potential activity related to the SectopRAT loader by monitoring the execution sequence of 'ReportDump.exe'. The rule identifies the side-loading of a specific DLL ('sdkcra.dll') followed by the process reading a known configuration or database file ('pool.db') within a short time window, which is indicative of the loader's secondary decryption phase.
Detects potential activity related to the SectopRAT loader by monitoring the execution sequence of 'ReportDump.exe'. The rule identifies the side-loading of a specific DLL ('sdkcra.dll') followed by the process reading a known configuration or database file ('pool.db') within a short time window, which is indicative of the loader's secondary decryption phase.
Page 107 of 864