Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,130 detections
Filters
Last updated
All Time
Detection languages
6,549
6,210
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,130
15,658
12,604
8,415
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects network traffic originating from the local network to external destinations that exhibit characteristics associated with the Xray-core tool, specifically the use of a spoofed TLS Server Name Indication (SNI) of 'dl.google.com' paired with a server certificate that does not contain 'Google' in the subject. This technique is used to bypass network filters by masquerading command and control traffic as legitimate Google traffic.
Detects the GHAPPIER loader payload concealed as a single line deep inside a large (~99KB) legitimate-looking JavaScript file, fetching and eval'ing remote code
Detects the GHAPPIER loader payload concealed as a single line deep inside a large (~99KB) legitimate-looking JavaScript file, fetching and eval'ing remote code
Detects the GHAPPIER loader payload concealed as a single line deep inside a large (~99KB) legitimate-looking JavaScript file, fetching and eval'ing remote code
Detects the GHAPPIER loader payload concealed as a single line deep inside a large (~99KB) legitimate-looking JavaScript file, fetching and eval'ing remote code
Detects instances where a process deletes its own executable or script file within 15 seconds of being launched. This behavior is often associated with self-modifying implants, transient scripts, or malicious artifacts attempting to minimize their footprint on the host system immediately after execution.
Detects instances where a process deletes its own executable or script file within 15 seconds of being launched. This behavior is often associated with self-modifying implants, transient scripts, or malicious artifacts attempting to minimize their footprint on the host system immediately after execution.
Detects instances where a process deletes its own executable or script file within 15 seconds of being launched. This behavior is often associated with self-modifying implants, transient scripts, or malicious artifacts attempting to minimize their footprint on the host system immediately after execution.
This rule captures all successful authentication events with a populated source IP address. It serves as a foundational data collection rule for downstream security analytics, enabling the correlation of sign-in events against historical user geolocation baselines, ASN/ISP reputation feeds, and the detection of proxy or suspicious infrastructure usage.
Detects the obfuscated first-stage JavaScript payload sharedLoad.min.js dropped by the malicious npm indexed-btree package, identified by string-array encoding and self-checksumming array rotation obfuscation patterns
Detects the obfuscated first-stage JavaScript payload sharedLoad.min.js dropped by the malicious npm indexed-btree package, identified by string-array encoding and self-checksumming array rotation obfuscation patterns
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
This rule detects the execution of the SentinelOne memory scanner process (SentinelMemoryScanner.exe) or the loading of the associated SentinelOne core library (SentinelAgentCore.dll) from a directory path outside of the standard SentinelOne installation locations (Program Files\SentinelOne or Program Files (x86)\SentinelOne). This behavior is indicative of potential masquerading or tampering where an adversary attempts to execute a renamed or moved security tool to bypass policy or evade detection.
Detects network requests to the Microsoft authentication service specifically targeting the /common/oauth2/deviceauth endpoint, which is used in the OAuth 2.0 Device Authorization Grant flow. While legitimate for device authentication (e.g., CLI tools, smart devices), this flow can be abused by adversaries for phishing attacks to bypass traditional credential-based MFA, allowing them to gain persistent access to a user account once the target authorizes the code.
Detects HTML phishing lures associated with the GhostCode kit, which utilizes obfuscation techniques such as zero-font-size <ins> tags and injected HTML comments between characters to bypass static and NLP-based security analysis.
Detects attempts to delete, truncate, or overwrite critical system logs and user command history files (such as /var/log/auth.log, syslog, or .bash_history) on Linux systems using common utilities like rm, shred, and truncate. The rule includes exclusions for legitimate system maintenance processes like logrotate and cron.
Detects execution of PowerShell or CMD initiated by the Kimsuky GitPower loader. The rule identifies suspicious command-line artifacts including excessive character padding (leading spaces), extremely long command lines, and the presence of a hardcoded, unique base64 decoding variable ('$VIUSBvejbawf') associated with this specific malware family.
Detects the Kimsuky second-stage payload test.bef_fri which masquerades as an RTF file via a falsified RTF header before header repair and decompression
Detects the presence or execution of a specific file hash associated with a known malicious campaign (KREMLIN/REF9334) that leverages a signed SentinelOne binary. This indicates potential abuse of trusted code-signing to bypass security controls.
Detects the loading of 'libcurl.dll' or related DLL patterns from suspicious directories such as '\Microsoft\Crypto\RuntimeBroker\', often associated with process masquerading or side-loading activities. The rule also monitors for the execution of suspicious binaries ('Tax_Notice_45594.exe') or binaries that mimic 'Notepad++' metadata from within these paths.
Detects the presence or execution of a specific file hash associated with a known malicious campaign (KREMLIN/REF9334) that leverages a signed SentinelOne binary. This indicates potential abuse of trusted code-signing to bypass security controls.
Page 119 of 864