Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the creation or modification of Exchange mailbox rules using the New-InboxRule or Set-InboxRule cmdlets that perform automatic forwarding or redirection of email to external, non-trusted domains. This technique is commonly employed during account takeover events to facilitate covert data exfiltration.
Detects a multi-stage infection chain associated with RedFlick, involving the delivery of VHDX files or PDF attachments. The rule correlates malicious activities such as SSH-based tool download (using PermitLocalCommand), PowerShell-based PDF decoding/extraction, PowerShell VHDX disk mounting, and silent MSI installation from remote URLs. It monitors for these activities within user-writable directories like Downloads or Temp.
Detects 2CLoader samples containing the embedded config magic bytes alongside rolling-XOR, AES-GCM, and sha256-seed-derived key material used in its payload decryption chain
Detects instances where a service account, identified by 'svc' in the account name, logs on and is assigned special privileges (Event ID 4672). This rule excludes computer accounts (ending in $) to minimize noise, as service accounts typically operate with specific, limited privileges and unusual privilege assignment could indicate an adversary abusing a service account for persistence or privilege escalation.
Detects the execution of PowerShell with encoded command arguments (e.g., -enc, -EncodedCommand) combined with common web-request cmdlets or download-cradle patterns (e.g., IEX, Net.WebClient, Invoke-WebRequest). This pattern is frequently used by adversaries to execute obfuscated remote payloads in memory.
Detects repeated occurrences of 'ValidationException' errors in AWS Bedrock 'InvokeModel' and 'Converse' API calls. This activity is indicative of an attacker attempting to probe or validate the usability of stolen AWS credentials by sending deliberately malformed requests, aiming to confirm successful authentication without triggering common access-related alerts.
This rule detects PowerShell processes initiated with command-line arguments that indicate obfuscation (e.g., -enc, -encodedCommand) or attempts to download or execute external content (e.g., IEX, Net.WebClient, Invoke-WebRequest). This pattern is commonly observed during the initial execution of malicious payloads or tool delivery.
Detects suspicious PowerShell process creation patterns often associated with malicious activity. The rule identifies PowerShell execution invoked by common parent processes (like Office applications or scripting engines) or using highly suspicious command-line arguments such as encoded commands, hidden windows, or common download and execution patterns (e.g., IEX, WebClient).
Detects network or system activity associated with the 'p2pwn' backdoor account on Dahua cameras, which is introduced by exploiting the CVE-2024-39943 vulnerability. The rule monitors for the presence of 'p2pwn' and 'p2password' strings across logs, including RPC/login events.
Detects PowerShell execution that modifies the 'jquery.mousewheel-3.0.6.pack.js' file while simultaneously attempting to timestomp file metadata or utilizing specific obfuscation markers identified in webshell deployment patterns.
Detects Microsoft Entra ID (formerly Azure AD) sign-in attempts that use the specific, hardcoded User-Agent string associated with the TeamFiltration tool. This tool is frequently used for mass credential testing against Microsoft 365 environments. The detection looks for a suspicious and outdated combination of Teams, Electron, and Chrome versions that would not be present in legitimate, modern Microsoft Teams client traffic.
Detects the loading of an unsigned or invalidly signed DLL from commonly abused user-writable directories (Temp, AppData, Public). This behavior is characteristic of DLL side-loading techniques, often used by threat actors like the Lazarus Group to execute malicious code via a legitimate, trusted application.
Detects a suspicious sequence where a process loads the .NET CLR (clr.dll or mscoree.dll) and shortly thereafter accesses specific low-prevalence file extensions (.raw or .pak) within high-risk directories (AppData/Local/Temp, ProgramData, or Users/Public). This behavior is characteristic of shellcode loaders (such as the WAV-shellcode loader) that decrypt and execute RAT payloads from obfuscated containers in memory. The rule intentionally excludes common desktop applications to minimize false positives.
Detects a file named dnsapi.dll created/modified outside System32/SysWOW64/WinSxS (the only legitimate locations for the real system DLL). Now requires the file to BOTH land in one of the known NeedyMantis sideload staging folders AND match the published 3448-byte spoofed-config size -- previously the size check alone could match unrelated dnsapi.dll copies anywhere on disk; requiring both signals together removes that bypass.
Detects a suspicious pattern where a user authenticates to a remote access portal (like Citrix or VPN) without multi-factor authentication (MFA) or with an existing risk flag, followed by a surge in file activity (creation, modification, or renaming of >500 files or >200 distinct files) on the same account within a 24-hour window, potentially indicating compromised credential usage for staging data for exfiltration or ransomware.
Detects DNS queries for the domain 'docsportal.in', which is associated with the SideCopy threat group's HTA-staging activity for delivering the ReverseRAT malware.
Detects a sequence of events indicative of an account takeover (ATO) attack, starting with a help-desk initiated password reset, followed immediately by new MFA factor or device enrollment, and concluding with an application login from an unrecognized device or location.
Detects the specific behavior of the NeedyMantis malware where a file named 'encryptbase64.ps1' is written to disk but is not subsequently invoked by any PowerShell process. This is indicative of shellcode masquerading as a script file, where the file is loaded directly into a process's memory to perform ROR-based API hashing and unpacking of a minimized PE loader.
Detects a suspicious sequence of events characteristic of NeedyMantis's hands-on-keyboard activity. The rule identifies file staging (creation or modification of suspicious DLLs from network shares) followed by remote command execution (via Impacket-like service interaction) and subsequent execution of binaries vulnerable to DLL sideloading.
Detects emails from free-mail domains (@mail.com or @outlook.com) that contain a specific malicious infrastructure indicator in the InternetMessageId or originate from a known suspicious IP address associated with TA419-style spoofing campaigns. This indicates the email was relayed through unauthorized infrastructure rather than the expected legitimate mail providers.
Detects the creation of persistence mechanisms through both Registry Run keys and Scheduled Tasks within a one-hour window, specifically targeting names indicative of masquerading as legitimate update or helper components.
Page 20 of 864