Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects potential ransomware activity by correlating risky user identity events (such as impossible travel or malicious IP access) with subsequent endpoint behavior typical of ransomware, specifically the deletion of shadow copies or system backups, or mass file modification activity occurring within a short window.
This rule detects anomalous activity involving guest users (external identities) or service principals in Azure AD (Microsoft Entra ID). It baselines typical behavior—including IP addresses, countries, and sign-in frequency—over a 14-day period and alerts when activity in the last 24 hours deviates significantly. This includes sign-ins from new IP addresses or countries, sudden spikes in sign-in volume, after-hours access, or failed authentication attempts, which may indicate account takeover or misuse of third-party vendor access.
Detects the loading of WMI-related DLLs (wbemcomn.dll, wbemprox.dll) by processes that are commonly abused to proxy execution (LOLBins) such as certutil, mshta, or office applications. This behavior is often associated with WMI-based persistence or execution techniques.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a single GitLab token/account holding Owner-level access across an unusually large number of projects (50+), the standing-privilege condition that turned one leaked token into a 55-project supply-chain exposure.
This rule detects potentially malicious activities aimed at credential harvesting and system recovery inhibition. It monitors for the execution of vssadmin.exe with arguments to list shadow copies (often a precursor to deletion) or references to DPAPI master keys in command lines. Additionally, it identifies unauthorized processes attempting to access sensitive browser-based credential files (e.g., Login Data, Cookies, key4.db) from standard browser installation paths, specifically excluding legitimate browser and update processes.
Detects successful network connections to a known hVNC RAT (GapiUpdate) C2 infrastructure IP address on port 5556, based on DeviceNetworkEvents logs.
Detects successful network connections to a known hVNC RAT (GapiUpdate) C2 infrastructure IP address on port 5556, based on DeviceNetworkEvents logs.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
This rule detects instances where Google Workspace flags a sensitive action as risky (such as sign-ins from suspicious locations, unusual devices, or known-bad IPs), yet the action is allowed to proceed. This indicates a potential bypass of security controls or an account compromise where an adversary is utilizing a valid account despite triggered risk indicators.
Detects the creation, modification, or renaming of unsigned executable files (.exe, .dll, .sys, .efi) within critical Windows system directories (System32, SysWOW64, drivers, boot). The rule excludes activity triggered by known trusted OS update processes, such as TrustedInstaller or Windows Update services, and optionally flags occurrences outside defined maintenance windows.
Detects the loading of 'Adblock.dll' by the executable 'eld2.exe', specifically when 'eld2.exe' is executed as a child process of 'windirstat.exe'. This behavior is indicative of DLL side-loading where a legitimate or potentially malicious application is used to load a secondary library.
This rule detects potentially malicious behavior associated with Microsoft Office applications, such as Word, initiating suspicious WebDAV network connections, dropping executable or sensitive files, or spawning known LOLBAS processes (rundll32, explorer, regsvr32) from suspicious directories like Temp or WebDAV paths. It also includes a blocklist for known malicious file hashes associated with these patterns.
Detects PE binaries masquerading as Microsoft's Windows Update Assistant via forged VersionInfo metadata combined with an unsigned or invalid/unverified digital signature, associated with HVNC backdoor delivery
Detects the creation of specific mutex objects ('AppUpdateHelper' or 'WinSvc') commonly associated with Hidden VNC (hVNC) backdoors. These mutexes are used by the malware to ensure only one instance is running on the host, and the regex pattern targets the specific naming convention (including a hex suffix) utilized by these threats.
Page 160 of 864