Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Identifies regsvr32.exe utilizing scrobj.dll to execute a remotely hosted malicious COM script.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects PowerShell script used to extract hidden payloads from BMP image files via RGB pixel channel parsing, as observed in multi-stage Remcos RAT loader campaign. This technique is often used to conceal malicious code within seemingly innocuous image files.
Detects `cmd.exe` starting PowerShell with hidden-window, bypass execution policy, and encoded-content options, which is a common technique used by malware like Banana RAT to evade detection and execute malicious scripts. The rule specifically looks for PowerShell or pwsh.exe being launched with command-line arguments indicating hidden windows, execution policy bypass, or encoded commands, with `cmd.exe` as the parent process.
Detects modifications to Azure AD domain federation settings or authentication methods that could indicate attempts to establish persistent access or bypass authentication controls (e.g., golden SAML attacks, domain-level backdoors). The rule monitors for successful operations related to domain federation, authentication changes, and domain management, excluding known administrative actions from internal Microsoft domains.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
Detects the ZiChatBot dropper export and parameter combination used to initialise payload decryption and execution. Specifically, it looks for rundll32 or python/python3 executing 'terminate.dll' with 'envir' and 'xterminalunicod' in the command line.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects a driver containing strings associated with the SprySocks malware, specifically related to Windows Filtering Platform (WFP) manipulation and the 'RawWNPF' string. The rule looks for the presence of 'RawWNPF', 'FwpmEngineOpen', 'FwpmFilterAdd', 'FwpmSubLayerAdd', and 'Delivery Optimization' within a file identified as a Windows executable (MZ header).
Detects MYRA RAT install-guard.js preinstall hook forcing re-execution with sudo npm install -g apintergrationpost to gain root privileges
Detects collection of event log size, retention, record count, and audit policy categories to understand defensive visibility. This rule specifically looks for the execution of 'powershell.exe' with 'Get-WinEvent -ListLog Security' or 'auditpol.exe' with '/get /category' command-line arguments.
Identifies attackers renaming the ClickOnce executable (dfsvc.exe) to bypass basic AppLocker path rules. This rule specifically looks for instances where the original file name is 'dfsvc.exe' but the current file name is different, indicating a rename.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
Detects sandbox evasion via sbiedll.dll presence check (T1497.001) followed by rapid process termination indicating the malware detected a sandbox and aborted execution, as observed in the FortiBleed steganographic loader campaign.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects the self-deletion pattern used by the Supper backdoor, which involves a specific 'ping' command delay structure followed by a 'Del /f /q' command to remove itself from disk after execution. This pattern has been associated with Interlock and Rhysida ransomware.
Detects the silent extraction of ZIP archives using the native Windows tar.exe utility into application data directories. This behavior is indicative of the Potemkin Loader, where attackers stage malicious payloads following an initial download to evade detection.
Page 346 of 864