Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects command-line execution of 'rm' or 'cp -a' targeting specific sensitive system, credential, or configuration files on Linux systems. This behavior often indicates an attempt to remove evidence, destroy logs, or stage sensitive data for exfiltration.
This rule detects potential Remote Access Trojan (RAT) activity by identifying specific indicators associated with Nuitka-compiled binaries, specifically the 'chost.exe' filename or paths containing 'win-driver-xd7d'. Additionally, it monitors for suspicious Python-based loader executions ('loader.py') initiated from temporary directories, which is a common persistence or execution technique for such malware.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. The rule looks for known bypass strings, memory patching via Marshal, reflection-based disabling of AmsiUtils, or base64-encoded AMSI patch targets.
Detects execution of PowerShell processes (powershell.exe, pwsh.exe) containing command-line arguments indicative of Antimalware Scan Interface (AMSI) bypass attempts. This includes known bypass strings, reflection-based patching of memory internals (AmsiUtils, GetDelegateForFunctionPointer), and base64-encoded fragments of common bypass techniques.
Detects the abuse of the Windows utility mshta.exe to execute potentially malicious scripts or remote HTML applications (HTA). The rule looks for command-line arguments involving remote URL fetches (HTTP/HTTPS/UNC) or inline script execution (vbscript/javascript), which are common techniques for bypassing security controls and executing payloads.
Detects attempts to clear Windows event logs using the native command-line utility 'wevtutil' or PowerShell cmdlets 'Clear-EventLog' and 'Remove-EventLog'. Adversaries often perform this action to remove evidence of their activities from security, system, and application logs. The rule includes exclusions for common administrative, backup, and security-related processes to minimize false positives.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
Detects attempts to disable the Windows Firewall using the netsh command-line utility or PowerShell cmdlets, as well as registry modifications related to firewall profiles. Adversaries often perform this action to impair host-based security controls and facilitate unauthorized inbound or outbound network traffic.
Detects HTTP traffic where the User-Agent header references Regasm or Regsvcs, which are trusted Windows utilities often abused by attackers to proxy execution of malicious code (Living-off-the-Land Binary technique).
Detects indicators of exploitation related to CVE-2026-20245 on Cisco Catalyst SD-WAN controllers, including malicious tenant CSV uploads, unauthorized account creation (troot), privilege escalation via su, anti-forensic backup of system configuration files, and configuration changes such as PermitRootLogin enabled.
Detects SMB authentication attempts using NTLM with a blank Lan Manager (LM) hash. This specific pattern is often associated with Pass-the-Hash attacks where tools inject malformed or blank hashes to initiate authentication, a common indicator of lateral movement attempts.
This rule detects potentially malicious modification of sensitive configuration files (e.g., /etc/ssh/sshd_config, /etc/passwd, /etc/shadow) or the execution of chmod/chown commands on sensitive files. It also flags common persistence/backdoor techniques such as modifying SSH settings to allow root login or applying dangerous permissions (777, setuid, setgid) to binaries, which could facilitate privilege escalation.
Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.
This rule detects HTTP requests attempting to perform Local File Inclusion (LFI) or path traversal attacks by searching for patterns such as '/../' sequences and common sensitive file paths like /etc/passwd, /etc/shadow, or /proc/self/environ in the URI.
Detects Visual Studio Code or Cursor IDE spawning a node.js process that executes a payload disguised as a .woff2 font file. This behavior is associated with supply chain attacks where malicious npm packages use hidden VS Code workspace tasks (e.g., folderOpen) to execute arbitrary code.
Detects HTTP responses containing JavaScript files larger than 1 MB, which is a signature behavior of the Bluekit PhaaS platform. This technique involves serving periodically rotated, obfuscated JavaScript bundles to evade static hash-based detection mechanisms.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
This rule detects successful Azure AD authentication attempts originating from known hosting provider or VPS IP addresses, combined with anomalous behavior such as headless browser user agents, impossible travel, or high-risk sign-in flags. This pattern is indicative of Adversary-in-the-Middle (AiTM) phishing proxies like Evilginx or Bluekit, which attempt to bypass MFA by proxying the authentication process.
Detects processes that load .NET runtime assemblies (clr.dll/coreclr.dll) from non-standard paths while concurrently performing named pipe inter-process communication and initiating outbound network connections. This behavior is often indicative of fileless execution, living-off-the-land techniques, or lateral movement where a process is repurposed as a proxy or command-and-control conduit.
Detects the post-exploitation pattern associated with the DirtyClone (CVE-2026-43503) vulnerability, where a non-root process executes '/usr/bin/su' with the '-c /bin/sh' argument, resulting in a spawned shell running with root privileges. This behavior is indicative of an in-memory patch to the su binary's page cache, allowing for unauthorized privilege escalation without modifying the on-disk binary or triggering standard PAM authentication events.
Detects Kerberos AS-REQ (Event 4768) using certificate-based pre-authentication (PKINIT / PA-PK-AS-REQ) with AES256 encryption. This represents the second stage of a Shadow Credentials attack, where an adversary authenticates using a rogue key credential they previously wrote to msDS-KeyCredentialLink. The rule filters out legitimate PKI-issued certificates from specified CAs and computer accounts.
Page 313 of 864