Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects successful authentication events that rely on external authentication method providers, which may indicate an adversary is using a rogue MFA provider to bypass standard authentication controls or to perform adversary-in-the-middle (AiTM) attacks.
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
This rule detects potentially malicious command execution patterns in Linux environments. It monitors for shell commands (bash, sh, echo, tee, cat) involving base64 decoding redirected to shell configuration files (e.g., .profile) or specific patterns involving 'gs-dbus' processes, which are often used by threat actors to decode obfuscated payloads or maintain persistence.
Detects authentication events associated with known actor infrastructure (AnonyMousKIT/Cluster B/UKT) and identifies anomalous crossover patterns where a single source IP authenticates into multiple distinct accounts within a short time window. This behavior is indicative of a shared backend infrastructure across multiple accounts or storefronts.
Detects Workday self-service banking detail changes occurring shortly after suspicious mailbox reconnaissance activities, such as searching for payroll-related terms or accessing sensitive documents. This behavior is indicative of a payroll diversion fraud scheme following an Adversary-in-the-Middle (AiTM) session hijacking attack.
Detects Microsoft 365 / Entra ID sign-in events where the reported client application is Microsoft Outlook but the User-Agent string is inconsistent with Outlook's standard Edge-based WebView. This behavioral discrepancy often indicates the use of automated HTTP clients to replay stolen session tokens in Adversary-in-the-Middle (AiTM) phishing campaigns, allowing attackers to maintain authenticated access for reconnaissance and data collection.
Detects the creation or modification of O365 inbox rules designed to move incoming emails to the 'Deleted Items' folder, delete messages, or mark them as read. This behavior is a common indicator of an adversary attempting to hide phishing lures, security alerts, or C2 communications within a compromised mailbox.
Detects Microsoft Entra OAuth 2.0 device authorization grant flow completion immediately followed by non-interactive API access from automated user agents like python-requests. This behavior is indicative of device code phishing kits, where an attacker tricks a user into entering a code and then programmatically hijacks the resulting session token.
This rule detects when a DLL containing 'python' in its filename is loaded by a process that is not an identified Python interpreter or the dropbox.exe application. The rule specifically filters for these DLLs being larger than 10MB, which may indicate the use of embedded Python environments to facilitate malicious code execution or side-loading.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects sign-in events where Multi-Factor Authentication (MFA) was satisfied using an External Authentication Method (EAM) that asserts specific possession or inherence claims (e.g., 'hwk' - hardware key). This behavior may indicate an adversary attempting to bypass or forge MFA responses via a rogue EAM provider.
Detects sign-in events where Multi-Factor Authentication (MFA) was satisfied using an External Authentication Method (EAM) that asserts specific possession or inherence claims (e.g., 'hwk' - hardware key). This behavior may indicate an adversary attempting to bypass or forge MFA responses via a rogue EAM provider.
This rule detects potential Business Email Compromise (BEC) attempts where an attacker impersonates an executive (CEO, CFO, etc.) via email. It identifies emails where the Sender's display name suggests a high-level executive role, but the domain of the Reply-To address differs from the sender domain, which is a common indicator of a fraudulent routing attempt. The rule further narrows this down to emails with subject lines typical of financial-themed urgency or requests.
Detects instances where the legitimate Windows Character Map utility (charmap.exe) is spawned by suspicious processes or PowerShell, and subsequently loads clr.dll. This behavior is indicative of potential DLL sideloading or process injection techniques used by malware to execute arbitrary code within a trusted system process context.
Detects PowerShell or PowerShell ISE spawned directly from Windows Explorer (explorer.exe, covering both Start-menu launches and the Run dialog abused by ClickFix) whose command line carries a genuine obfuscation/evasion signal - true -EncodedCommand/-e usage, a hidden/minimized window flag, or a remote download cradle (IEX, Invoke-WebRequest, DownloadString, certutil, mshta, etc.) - while excluding invocations that point at an on-disk script file under a standard install path, since ClickFix payloads are inline one-liners rather than references to a local .ps1. Bare -NoProfile/-NoLogo flags no longer trigger alone, since they are common in legitimate automation.
Detects instances of an executable named msedge.exe running from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This is a suspicious location for a browser executable, often used by malware to masquerade as legitimate software to evade detection.
This rule detects processes manually resolving API function addresses by traversing the Process Environment Block (PEB) Ldr structure or parsing module export tables. This technique is often used by malicious code to resolve Windows API functions dynamically without relying on standard LoadLibrary or GetProcAddress calls, effectively evading common API-hooking based monitoring.
Detects the execution of a binary named 'msedge.exe' from within the 'Windows\Telemetry' directory. This behavior is indicative of the MovieReaper malware attempting to masquerade as the legitimate Microsoft Edge browser to evade detection and maintain persistence.
Page 124 of 864