Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects execution of a renamed pythonw.exe (userscreen.exe) from a suspicious location (Public\AccountPictures) that demonstrates short-lived execution characteristics indicative of a sandbox/VM evasion check, immediately followed by network connectivity to known NarwhalRAT C2 domains or pcloud infrastructure.
Detects inbound emails from 'gmail.com' where the sender's display name closely matches the recipient's local username part. This pattern is commonly used in business email compromise (BEC) and phishing attacks to impersonate colleagues or known contacts.
Detects the AMOS (Atomic macOS Stealer) infection chain where a shell (e.g., Terminal, bash) executes curl to download a DMG file to a temporary directory, followed immediately by the use of hdiutil with the -nobrowse flag to mount the disk image silently, effectively bypassing macOS Gatekeeper UI prompts to the user.
Detects automated lateral movement attempts using sshpass to perform password spraying or authentication against PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule specifically flags the use of sshpass with lax security settings (StrictHostKeyChecking=no), identifying a pattern associated with the uon_fanout.sh post-exploitation script.
Detects the execution of PowerShell scripts from the Windows Temp directory using common evasion flags (-NoProfile, -ExecutionPolicy Bypass, -WindowStyle Hidden). This pattern is consistent with loaders attempting to maintain persistence while obfuscating their execution context, specifically associated with steganographic malware campaigns.
Detects instances where the DonutLoader utility performs in-memory .NET payload execution. It identifies suspicious behavior by tracking the loading of clr.dll into a process that is not a recognized .NET host, concurrent with evidence of process hollowing techniques such as memory unmapping and process writing (NtUnmapViewOfSection, WriteProcessMemory, ResumeThread).
Detects instances where a non-browser, non-updater process attempts to perform process injection into common browser executables (Chrome, Edge, Firefox, IE). This behavior is consistent with process hollowing techniques used by Remcos RAT, particularly observed in campaigns such as FortiBleed, to masquerade malicious activity under legitimate browser processes.
Detects anomalous AWS API activity following a console login where the API calls originate from a different IP address within 10 minutes, potentially indicating the replay of stolen session tokens captured via Adversary-in-the-Middle (AiTM) techniques.
Detects Event 5136 where msDS-KeyCredentialLink is added to an AD object, indicative of Shadow Credentials abuse via Whisker/DSInternals. The rule filters out MSOL_ sync accounts and computer-to-computer self-writes to reduce false positives.
Detects execution patterns where security tools such as Microsoft Defender, Sysmon, and Filebeat are intentionally impaired or disabled using service control commands (sc.exe) and PowerShell cmdlets (Set-MpPreference), consistent with adversary activity aimed at bypassing security monitoring.
Detects the execution of bcdedit to configure the system boot into minimal safe mode. VECT ransomware uses this technique to evade security products on the next reboot.
Detects attempts to disable Microsoft Defender security features. The rule monitors for PowerShell cmdlets (Set-MpPreference), service control operations (sc.exe stopping WinDefend), and registry modifications to the 'DisableAntiSpyware' policy key, which are common methods used by adversaries to impair host-based security defenses.
Detects the creation of virtual machines or the attachment of virtual hard disks (VHDs) using Hyper-V management tools, PowerShell, or Windows Disk Management utilities. This activity is often associated with efforts to bypass endpoint security monitoring by executing payloads within an unmanaged guest VM environment.
Detects the systematic disabling or termination of security products and auditing tools on Windows systems, including Microsoft Defender, Sysmon, Filebeat, and WAF logging services. The rule triggers on process execution patterns associated with command-line tampering, service control manager manipulation, registry modifications, and the execution of specific batch scripts designed to impair defenses.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
Detects attempts to disable or tamper with Windows Defender via command-line utilities, PowerShell scripts, or registry modifications. This includes stopping services (sc/net), modifying Defender preferences (Set-MpPreference), and tampering with policy registry keys.
Detects the creation of Image File Execution Options (IFEO) registry entries that associate a debugger with common security-related or monitoring binaries (e.g., Sysmon, SetACL, Filebeat). Attackers use this technique to hijack the execution flow of these security tools, effectively disabling or impairing their functionality (a form of defense evasion).
Detects attempts to disable Windows Defender features, including real-time, behavior, and script scanning monitoring, as well as modifications to the 'DisableAntiSpyware' registry key, disabling system recovery via bcdedit, or execution of common scripts used to disable Windows Defender.
Detects coordinated efforts to impair host-based security by disabling Microsoft Defender via Set-MpPreference, terminating security agent processes (e.g., Sysmon, Filebeat, SentinelOne), stopping security services, or executing known security-disabling PowerShell scripts.
Detects the modification or creation of .aspx files within the ColdFusion 'wwwroot\Images' directory. The rule flags both known webshell filenames and generic .aspx files that are not modified by the IIS worker process (w3wp.exe), which is indicative of unauthorized file manipulation or webshell deployment.
Detects the modification of the WDigest registry key 'UseLogonCredential' to 1. This configuration forces the Windows LSA process to store plaintext credentials in memory, significantly facilitating credential harvesting techniques such as those employed by Mimikatz.
Page 318 of 864