Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.
Detects the use of the Windows attrib.exe utility to modify file attributes, specifically targeting the addition of hidden (+h) or system (+s) attributes. The rule looks for these modifications in suspicious locations or contexts, such as ProgramData, IDM log directories, or in association with specific application filenames, which may indicate attempts to hide malicious files or persistence mechanisms.
Detects the clearing of Windows event logs using the native 'wevtutil.exe' utility. This behavior is a common indicator of anti-forensics activity where attackers attempt to remove evidence of their presence or actions on a compromised host.
Detects the use of the Windows 'attrib.exe' utility to set the hidden (+h) attribute on files or directories within 'ProgramData' or 'AppData' paths. This behavior is frequently associated with the Mustang Panda threat group to conceal malicious artifacts, such as the SHARDLOADER and ZOHOMURK implants, from standard user visibility.
Detects the use of built-in Windows administrative utilities (icacls, cacls, takeown, attrib) to modify file permissions or attributes. This behavior is commonly observed during the staging phase of The Gentlemen ransomware attacks to restrict user access to files or hide malicious payloads prior to encryption.
Detects suspicious executions of Python interpreters or Pip package managers originating from common development tools (like VS Code or Node.js) or utilizing temporary file paths. The rule also monitors for suspicious command-line arguments that indicate obfuscation, encoded payloads, or the use of dynamic evaluation functions.
This rule detects the loading of specific DLL files (SolidPDFCreator.dll, ctxmui.dll) by suspicious or masquerading process names (pcl2bmp.exe, Project Proposal.exe, Memorandum of Understanding.exe) from common user-writable or temporary directories, which is often indicative of side-loading or execution of malicious components.
Detects indicators of Mustang Panda activity, specifically identifying the loading of known malicious side-loaded DLLs (SolidPDFCreator.dll, ctxmui.dll) or anomalous process behavior originating from staging directories (e.g., \ProgramData\IDM\logs\) and binaries (MediumInstStart.exe, pct2bmp.exe) that interact with common system or browser processes.
Detects execution of a Python runtime loading a compiled bytecode file disguised with a '.cat' extension, a key defense evasion technique of NarwhalRAT.
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe, a technique used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
Slack Anomalous Activity Detected
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that could indicate a compromised account or unauthorized access to a Slack workspace.
Slack Anomalous Activity Detected
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that could indicate a compromised account or unauthorized access to a Slack workspace.
Detects attempts to stop or modify critical Windows security services (Windows Defender, Security Center, Security Health Service) using the Service Control utility (sc.exe). This activity is often indicative of an adversary attempting to impair defenses.
Detects the deletion of PowerShell console history files (ConsoleHost_history.txt) within the PSReadLine folder. This activity can be indicative of an attacker attempting to remove forensic evidence of their commands, often seen in post-exploitation phases to hinder incident response and hide malicious activities.
Detects firmware updates pushed from unverified or IP-only sources
Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query string, which are indicators of ErrTraffic webshell activity.
Detects TLS callback injection using IMAGE_TLS_DIRECTORY structures
Detects LogonUser API used with token impersonation for privilege escalation
Detects downgrade of network device firmware potentially to reintroduce vulnerabilities
Detects port knocking sequences used to activate hidden backdoors
Page 322 of 864