Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects PowerShell commands executed by a Node.js process to gather system information, specifically targeting installed applications and packages. This could indicate malicious activity where a Node.js application or script is being used to enumerate system details.
Detects the execution of known OXLOADER malware samples from temporary directories or download locations. The detection focuses on identifying specific filenames and file paths, while the rule metadata highlights the malware's behavior of performing geofencing checks (e.g., CIS region evasion) using Windows API functions to determine the system's locale.
Detects the creation of a .ps1 script in the Windows AppData\Local\Temp directory followed by the execution of that script via PowerShell using hidden window flags (-WindowStyle Hidden) and policy bypass options (-ExecutionPolicy Bypass). This pattern is commonly associated with persistence mechanisms used by steganographic loaders to execute obfuscated payloads.
Detects malicious Python or JavaScript package archives (such as those used in dependency confusion attacks) that contain obfuscated code execution logic (base64 encoded commands) within package installation hooks (setup.py), or those embedding suspicious binary executables (PE/ELF headers) within the package structure.
Detects HTTP response bodies containing specific strings associated with the 'Montana Empire' phishing kit. This rule monitors for indicators that a web server is serving a phishing credential harvesting page.
Detects behavior patterns associated with Payouts King ransomware, including direct syscall-style API calls (NtAllocateVirtualMemory, NtWriteVirtualMemory, CreateRemoteThread) from processes other than trusted system binaries, and the loading of ntdll.dll from non-standard file paths (outside System32/SysWOW64). It also includes a hash-based detection for known Payouts King malicious samples.
This rule detects suspicious memory manipulation and thread injection activities directed at 'svchost.exe' or 'explorer.exe' by processes other than standard system components. Such behavior is often indicative of malicious code injection, where an attacker attempts to run arbitrary code within the address space of trusted system processes to bypass security controls or achieve persistence.
This rule monitors for unauthorized changes to sensitive system, authentication, and configuration files, as well as the deletion or truncation of logging artifacts on SD-WAN appliances. This activity is indicative of an adversary attempting to modify credentials, evade detection, or clear their footprint by tampering with security-critical paths.
Detects session hijacking attempts where a session cookie is used from a different IP address or user-agent immediately following a successful MFA authentication event. This behavior is indicative of an adversary replaying a stolen session token.
This rule detects potential Bluekit malware activity by identifying specific CSS filter function combinations (saturate, hue-rotate, brightness, and contrast) within HTTP header data. These functions are used by Bluekit to generate unique pixel hashes for page loads, intended to bypass screenshot-based detection. The rule also flags instances where these headers co-occur with content-length and javascript identifiers.
Detects SSH network connections initiated by common administrative service accounts 'vmanage-admin' or 'troot' using the ssh or sshd process. This pattern may indicate unauthorized use of these service accounts or anomalous remote access behavior.
Detects the execution of mshta.exe followed by the execution of a .dat file, consistent with the Turla STOCKSTAY campaign. The rule monitors for mshta.exe spawning suspicious processes or executing payloads masquerading as data files (e.g., styles.dat) to achieve malicious functionality.
Detects session hijacking consistent with Browser-in-the-Middle (BitM) attacks like Bluekit PhaaS, where an attacker captures an authenticated session token. The rule identifies instances where a successful MFA-protected login event is immediately followed by a session reuse event from a different IP address or network location, which is indicative of the attacker utilizing the intercepted session.
This rule monitors for suspicious file operations on Cisco vManage, vSmart, and vBond network devices. It detects attempts to delete system logs, unauthorized access or copying of sensitive system files (such as /etc/passwd or /etc/shadow), and the presence of suspicious strings in command lines that may indicate anti-forensic activity or the creation of rogue accounts.
This rule detects potentially malicious web content by identifying the use of randomized or specific combinations of CSS filters (saturate, hue-rotate, brightness, contrast) within HTML responses. These techniques are often used by attackers to obfuscate malicious content, such as phishing pages, from automated scanners and security filters. The rule also incorporates a check for unusually large JavaScript bundle sizes, which may indicate the presence of injected malicious scripts.
Detects STOCKSTAY .NET backdoor components (e.g., STOCKMARKET, STOCKTRADER) accessing their encrypted 'fonts' configuration files located in the local application data SMN directory. These components use environmental keying (hostname or domain-based) to decrypt the configuration, a technique designed to thwart analysis.
This rule detects potential rootkit activity by monitoring for specific DeviceIoControl requests (code 2248E0), the presence of a suspicious file (402.sys) in the ProgramData directory, and specific NamedPipe events (NSecKrnl). These indicators are often associated with kernel-level malicious implants or rootkits attempting to hide their presence or interact with the system at a low level.
Detects successful sign-ins to specific Azure AD applications known to bypass Conditional Access policies, where Conditional Access was not applied. This could indicate an attempt to circumvent security controls.
This rule detects successful network logons (LogonType 3) using NTLM (NTLMv1 or NTLMv2) where the authentication results in an elevated token and the logon originates from a different workstation than the target computer. This combination of factors can indicate lateral movement attempts, especially when an adversary has obtained NTLM hashes (e.g., via Pass-the-Hash or NTLM relay attacks) and is attempting to authenticate to other systems on the network. The rule excludes machine accounts and anonymous logons, as well as loopback authentications, to reduce noise.
Detects Remcos RAT attempting process hollowing into common web browser executables. This rule identifies several indicators: creation of the 'Remcos_Mutex_Inj' mutex, a sequence of API calls (VirtualAllocEx, WriteProcessMemory, NtUnmapViewOfSection) targeting browser processes from a non-browser process, and the presence of a known Remcos payload MD5 hash (4924369C0BDAF73B21EB992EB9DB4DEA).
This rule detects potential DLL side-loading activity associated with the SilverFox threat actor, specifically targeting trojanized Panasonic and Philips OEM software. It looks for suspicious DLLs (UxEnhance64.dll, XPSPLOG.dll) being loaded, or legitimate Panasonic/Philips binaries loading DLLs from non-standard paths, including the Public user directory.
Page 338 of 864