Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects execution of rundll32.exe using ordinal-based export calling syntax to load suspicious DLLs (e.g., sys_<hex>.dll) or reference non-executable files (e.g., WindowsUpdate.log). This behavior is consistent with the CRPx0 Stage 2 stager, which typically exports crypto globals and lacks standard named exports.
Detects an authentication event followed by a computer account change event (Event ID 4742) targeting a domain controller computer account. This pattern may indicate unauthorized modifications to domain controller machine accounts, which is often associated with persistence or privilege escalation attempts.
Detects successful authentication events in Microsoft Entra ID (formerly Azure AD) that utilize the 'device code' OAuth flow. This flow is often used by command-line utilities and headless applications to authenticate users on devices without a web browser, but it is also frequently abused by attackers to perform phishing and session hijacking.
Detects anomalous activity in Azure AD/Microsoft Graph API logs, where a specific user or application performs a high volume of requests across multiple sensitive administrative categories (such as directory roles, authentication methods, applications, and service principals) within a 30-minute window. This behavior is often indicative of reconnaissance or privilege escalation attempts by an adversary who has compromised an identity.
Detects anomalous, high-frequency file access (100+ files within a 2-hour window) in Microsoft 365 (SharePoint or OneDrive) by users employing a Python-based HTTP client (python-httpx). This behavior is often indicative of automated data scraping, exfiltration, or bulk download activities performed by unauthorized scripts or compromised service accounts.
Detects obfuscated PHP web shell activity within the Admin Menu Editor Pro plugin, specifically looking for common obfuscation patterns like base64_decode, gzinflate, and str_rot13 combined with encoded payloads.
Detects a sequence of user activities—authentication, MFA registration, Graph API reconnaissance, and data exfiltration—originating from a rotating set of distinct source IP addresses for the same user within a 24-hour period. This behavior is indicative of coordinated infrastructure rotation tactics used by threat actors in cloud intrusions.
Detects anomalous usage of the OAuth 2.0 Device Authorization Grant flow (Device Code Flow). This flow is frequently abused by attackers to bypass MFA by tricking users into authenticating an attacker-controlled device or session, potentially leading to token theft or unauthorized access to sensitive enterprise applications.
Detects internal Microsoft Teams messages containing lures related to passkey or SSO enrollment, which is indicative of a compromised account attempting to perform lateral phishing to harvest credentials or bypass multi-factor authentication.
Detects instances where processes associated with AutoIt scripting (e.g., AutoIt-based compiled executables or scripts) initiate suspicious API calls including CreateRemoteThread, OpenProcess, or generic ProcessInjection against known target binaries such as RegSvcs.exe or mobsync.exe. These binaries are frequently abused for proxy execution or living-off-the-land techniques to hide malicious activity.
This rule detects the creation of files within the '\Users\Public\' directory that follow a specific, suspicious dynamic naming pattern: 'DeviceName@4AccountName'. Attackers often use the Public directory for staging malicious tools or payloads. This naming convention, which includes both the hostname and the executing account name, is highly indicative of automated, malicious activity or custom staging scripts.
This rule detects potential command and control (C2) beaconing activity associated with the Casbaneiro (Metamorfo) banking trojan. It looks for instances where a known suspicious process (RegSvcs.exe or mobsync.exe) performs network communication within 5 minutes of a web browser on the same device navigating to a targeted banking URL.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Detects instances where a non-SYSTEM process attempts to open a handle to winlogon.exe. Since winlogon.exe typically runs as SYSTEM and manages user sessions, unauthorized access to its process handle is often a precursor to credential dumping or token manipulation attacks aimed at escalating privileges to SYSTEM.
Detects instances where identified AI agents, bots, or automated assistants perform bulk access operations on mailboxes (e.g., MailItemsAccessed, Send, deletions) or data stores (e.g., FileDownloaded, FileAccessed, SearchQueryPerformed) in Microsoft 365 environments. This monitors for potentially compromised or malicious AI service accounts abusing legitimate access to harvest sensitive data.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
This rule detects the creation of files in directory paths that look similar to the legitimate 'C:\Windows\SysWOW64' folder but contain a hidden trailing space (e.g., 'C:\Windows \SysWOW64'). Attackers use this directory spoofing technique to hide malicious files or executables from users and some security tools that might not normalize the path correctly.
This rule detects the creation of files in directory paths that look similar to the legitimate 'C:\Windows\SysWOW64' folder but contain a hidden trailing space (e.g., 'C:\Windows \SysWOW64'). Attackers use this directory spoofing technique to hide malicious files or executables from users and some security tools that might not normalize the path correctly.
This rule detects the creation of files in directory paths that look similar to the legitimate 'C:\Windows\SysWOW64' folder but contain a hidden trailing space (e.g., 'C:\Windows \SysWOW64'). Attackers use this directory spoofing technique to hide malicious files or executables from users and some security tools that might not normalize the path correctly.
This rule detects the creation of files in directory paths that look similar to the legitimate 'C:\Windows\SysWOW64' folder but contain a hidden trailing space (e.g., 'C:\Windows \SysWOW64'). Attackers use this directory spoofing technique to hide malicious files or executables from users and some security tools that might not normalize the path correctly.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
Page 145 of 864