Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects execution of EDRChoker, a tool designed to impair EDR telemetry, when it is passed a process list text file as an argument. The rule specifically looks for command lines containing 'list.txt', an executable name (e.g., 'tool.exe'), and the string 'edr'.
Detects evidence of the MYRA Linux RAT executing payloads filelessly from memory using memfd_create and fexecve. The rule flags suspicious processes masquerading as systemd-userdbd, particularly when spawned from Node.js environments or associated with malicious packages like apintergrationpost or .libcache.so artifacts.
This rule detects potential browser fingerprinting activity or unauthorized WebRTC STUN requests, often associated with malicious landing pages, phishing, or automated detection evasion. It identifies the presence of specific browser API calls (RTCPeerConnection, navigator.deviceMemory, navigator.hardwareConcurrency) or suspicious use of STUN server ports (3478, 19302) on non-authorized domains.
Detects the spawning of DllHost.exe (a Windows COM surrogate process) by identified STOCKSTAY malware components or via suspicious msiexec installations targeting STOCKSTAY directories. This behavior is indicative of inter-process communication (IPC) used by Turla's STOCKSTAY malware suite.
Detects potential Browser-in-the-Middle (AiTM) credential relay attacks where a user clicks a malicious phishing URL, followed shortly by a successful interactive sign-in from a different IP address and a previously unseen device.
Detects instances where a single authentication correlation ID is associated with multiple distinct IP addresses within a 10-minute window, followed by high-risk administrative or data-access actions within 30 minutes. This behavior is indicative of session hijacking or post-authentication account compromise, where an adversary uses stolen session tokens to perform unauthorized activities.
Detects instances where msiexec.exe loads a DLL from non-standard system directories (outside of Program Files or Windows folders) with suspicious naming conventions (e.g., containing 'scheduler', 'update', or 'onedrive'), followed by network activity to public IP ranges or registry persistence modifications. This behavior is indicative of potential DLL side-loading or proxy execution by the Windows Installer binary to achieve persistence or command and control.
Detects the creation of scheduled tasks using names associated with Microsoft Edge or Google update processes to achieve persistence. The rule specifically targets the deployment of known payloads like TinyRCT (vmwared.exe) or PerfWatson.exe at logon with highest privileges, masquerading as legitimate update tasks.
Detects the execution of the VNT tunneling tool disguised as a legitimate VMware executable (vmwared.exe) located in C:\ProgramData\VMware\. The rule also identifies the creation of a scheduled task named 'MicrosoftEdgeUpdate' configured to execute the masqueraded binary at user logon with elevated privileges.
This rule detects potentially malicious PowerShell execution by identifying the use of obfuscated encoded commands or common execution policy bypass flags. It monitors for patterns such as '-EncodedCommand' with long strings, '-ExecutionPolicy Bypass', and other flags typically used to hide PowerShell execution or bypass security restrictions, while excluding trusted Microsoft-signed processes and commands executed from standard system paths.
Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.
Detects the execution of regsvr32.exe with command-line arguments indicative of 'Squiblydoo' style attacks, which use the signed Windows binary to proxy the execution of remote scripts or local COM scriptlets (.sct files). The rule specifically flags the use of /i with HTTP(S) URLs, loading scrobj.dll, or specific combinations of /s /u /i flags to bypass application control mechanisms.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
This rule detects when a non-administrative user grants an application high-privilege OAuth scopes (such as mail reading, file access, or directory management) within an Azure/Microsoft 365 environment. Such consent grants can be used by attackers to maintain persistence and bypass MFA by gaining delegated access to sensitive resources.
Detects high-impact configuration changes to Azure management groups or subscriptions (e.g., write/delete operations) that are performed by non-privileged accounts or outside of defined business change windows. This activity can indicate unauthorized privilege escalation, resource manipulation, or reconnaissance by an adversary.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
Detects a multi-stage attack chain where a system downloads a Python embeddable package via curl, renames the 'pythonw.exe' executable to an arbitrary name, and subsequently executes this renamed binary or a file containing 'config.cat', which is often indicative of automated malware deployment or persistence mechanisms.
Page 325 of 864