Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the spawning of suspicious child processes (e.g., cmd.exe, PowerShell, node.exe, calc.exe) by the Lunar Client application. This behavior is indicative of an exploit targeting the Electron framework's preload IPC bridge, allowing a renderer process to execute commands or gain elevated privileges on the host system.
Time-series correlation detecting Pass-The-Hash authentication behavior immediately following the extraction of LSASS memory.
This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.
Detects automated programmatic token refreshes (BAV2ROPC) originating from Railway IP space. This rule specifically looks for sign-in logs in Azure Active Directory where the UserAgent contains 'BAV2ROPC' and the IPAddress falls within known Railway PaaS IP ranges.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow.
Detects STOCKSTAY malware masquerading as an ILSpy installer using malicious MSI files (Copia.msi, DiplomacyEduAI.msi). The rule identifies the execution of a decoy lure URL through a custom OpenUrl MSI action that triggers the spawning of viewer.exe, as well as file activity associated with the installation path '%LOCALAPPDATA%/Programs/SMN/'.
Detects regsvr32 with silent, unregister, or scriptlet options referencing a remote or user-writable resource. This behavior is often associated with malware like InstallFix to execute malicious code.
Detects attempts to stop or clear Windows Event Logs using command-line utilities such as 'sc', 'net', or 'wevtutil'. This activity is often performed by adversaries to remove forensic evidence of their actions.
Detects evidence of AnyDesk exploiting an COM impersonation vulnerability via the adprinterpipe named pipe. The rule monitors for AnyDesk spawning SYSTEM-level child processes, interaction with the adprinterpipe, or modification of critical print-related registry keys.
Detects the suspicious installation and execution of a Python runtime from within a disguised directory (%LOCALAPPDATA%\Programs\Python\Python3127). This behavior is characteristic of an infostealer campaign that leverages Node.js to download archive files (python.zip, python.7z) and archiving tools (7zr.exe) to bootstrap a Python-based malicious payload.
Detects the deletion of a phishing-resistant authentication method (like FIDO2 security key or passkey) followed by the registration of a weaker authentication method (like a phone authentication method or software OATH token) for the same account. This pattern indicates a potential downgrade attack on an account's authentication security.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
Detects the Miasma worm utilizing the Bun runtime to execute malicious payloads. The detection looks for Bun processes executing scripts from /tmp/, specifically patterns associated with the Miasma worm, or processes matching the known malicious Bun runtime hash.
This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of malware staging, temporary file execution, or attempts to clean up forensic evidence.
Detects Active Directory dataset extraction techniques used by MexicanMafia (Operation Escaneo), including ntds.dit access, secretsdump execution, VSS shadow copy abuse, and BloodHound-style AD enumeration for long-term persistence and reconnaissance against critical infrastructure.
This rule detects the creation and execution of scheduled tasks used by StrikeShark's SharkLoader, often associated with Cobalt Strike, for persistence. It identifies suspicious scheduled task names that mimic legitimate Microsoft services (e.g., OneDrive, MicrosoftUpdate) and the execution of 'SystemSettings.exe' from unusual 'AppData' subdirectories ('xwreg' or 'xgdf'). The rule has three branches: detecting 'schtasks.exe' command-line usage to create such tasks, detecting 'ScheduledTaskCreated' events with the suspicious names or command patterns, and detecting 'SystemSettings.exe' execution from the specific 'AppData' subdirectories.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to gain persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
This rule detects potential memory-resident malware or staging activity by identifying instances where a high volume of DLL, OCX, or SYS files are loaded from user-writable directories (Temp, AppData, Users) on a specific device within a one-hour window. A threshold of 5 or more unique image loads from these locations is flagged as potentially suspicious, as it may indicate an attacker loading multiple malicious components or modules.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects EvilTokens phishing HTML page with AES-GCM encrypted payload by file hash and characteristic code patterns
Page 343 of 864