Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects potential DLL sideloading activity where legitimate, signed binaries (such as COTFileReadApp.exe or DeElevate64.exe) are executed from non-standard directories (e.g., AppData, Temp, Downloads) while loading specifically identified malicious or sideloaded DLLs. The detection identifies patterns where these binaries operate outside their expected vendor installation paths, indicating a likely attempt to hijack execution flow.
Detects instances where a process contacts multiple distinct AI-provider domains within a short time frame while simultaneously performing suspicious operations, such as accessing the LSASS memory, executing process injection, or establishing WMI persistence. This pattern is indicative of a potential 'ClosedQuorum' adversary behavior involving data exfiltration or AI-assisted malicious activity.
Detects the execution of known Windows 'Living-off-the-Land' binaries (rundll32.exe, regsvr32.exe, mshta.exe) when they originate from web browsers or office productivity applications, or when they are executed with command-line arguments indicative of network resource loading, remote scripting, or code execution bypasses.
Detects instances where an alert marked as process injection (T1055) involves an action process that is unsigned and differs from the actor process image, suggesting potential execution of an unauthorized or malicious payload masked by process injection techniques.
Detects the abuse of built-in Windows binaries 'regsvr32.exe' and 'msbuild.exe' for proxy execution. Specifically, it flags 'regsvr32.exe' loading remote scriptlets via HTTP and 'msbuild.exe' processing project files containing inline tasks, which are common techniques used to execute arbitrary malicious code while bypassing security controls.
Detects successful authentication attempts by the same user account from two different geographic locations within a timeframe that is physically impossible to travel between. This detection often highlights compromised accounts or session token theft, including scenarios where MFA mechanisms have been bypassed.
This rule detects potentially malicious PowerShell activity by identifying common obfuscation patterns, including encoded commands (Base64), IEX (Invoke-Expression) download cradles, and execution with hidden windows. It triggers when multiple suspicious flags are present or when an unusually long encoded blob is identified in script blocks, command lines, or process arguments.
This rule detects the loading of a suspicious DLL file named 'active_desktop_render_x64.dll' or the initiation of activity by a process named 'PDF_C2089_20260911100446.exe', which may indicate the execution of malicious code or potential process injection activity.
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Detects the execution of mshta.exe with arguments pointing to remote URLs or containing JavaScript. This behavior is commonly associated with phishing campaigns where attackers use fake CAPTCHA lures to trick users into executing malicious scripts via mshta.exe, often launched directly from Windows Explorer (e.g., from a downloaded file).
Detects potential reflective DLL injection or process hollowing attempts by monitoring for high-privilege cross-process access (ProcessAccess EventID 10) or remote thread creation (CreateRemoteThread EventID 8). These methods are frequently used by attackers to execute malicious code within the memory space of a legitimate target process, thereby evading traditional signature-based detection.
Detects potential Pass-the-Hash (PtH) activity where a single user account performs NTLM Type 3 (network) authentications to three or more unique destination hosts within a 10-minute window, excluding service account activity (trailing $). This pattern is consistent with an adversary moving laterally across a network using harvested NTLM hashes.
Detects the 'mscopilot.exe' binary performing token manipulation operations (DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken) followed by the creation of a new process with a different security context (CreateProcessAsUserW) within a five-minute window, indicative of C2 agent functionality.
Detects the 'ClickFix' attack pattern where explorer.exe (typically via a Run dialog interaction) spawns a command shell (PowerShell, cmd, or mshta) using obfuscated flags combined with execution indicators (download/execution), which then subsequently spawns a secondary child process. This chain provides high-confidence evidence of malicious intent compared to isolated process executions.
Detects anomalous lateral movement behavior where a user account authenticates via NTLM (Logon Type 3) to at least three different hosts within a 10-minute window and subsequently accesses administrative network shares (ADMIN$ or C$) on one or more of those target systems.
This rule detects various forms of process injection (Remote Thread, APC, Map View of Section) targeting common, high-value Windows processes such as explorer.exe, lsass.exe, and web browsers. This behavior is a common technique used by attackers to gain persistence, elevate privileges, or execute code within the context of legitimate system or user-level processes to evade detection.
Detects execution of AgtaBackupAgent.msi via command-line tools such as PowerShell or msiexec.exe. This activity is monitored as it may indicate an attempt to install backup software or potential malicious masquerading using the MSI installer, particularly when using silent flags or accessing from temp directories.
Detects execution of AgtaBackupAgent.msi via command-line tools such as PowerShell or msiexec.exe. This activity is monitored as it may indicate an attempt to install backup software or potential malicious masquerading using the MSI installer, particularly when using silent flags or accessing from temp directories.
Detects msiexec.exe spawned from explorer.exe, consistent with a user double-clicking a malicious .lnk shortcut, where the command line triggers the installation of an MSI package hosted on a remote HTTP/HTTPS server. This behavior is a known initial access technique used by FIN7 to deliver malicious payloads.
Detects anomalous, high-volume file download or export activity originating from a single identity across multiple downstream cloud applications or tenants within a one-hour window. This behavior is indicative of a compromised shared service provider, MSP, or clearinghouse account being leveraged to exfiltrate data from multiple client environments simultaneously. The detection excludes pre-approved service accounts and relies on a dynamic baseline comparison rather than a static threshold.
The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.
Page 22 of 864