Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the use of regsvr32.exe to execute remote scriptlets (SCT files) via HTTP, HTTPS, or FTP protocols. This technique, often referred to as 'Squiblydoo', allows for proxying code execution to bypass application whitelisting and execute arbitrary code directly from a remote web server without writing the script to the local disk.
Detects execution of the Microsoft .NET Framework InstallUtil.exe utility when it is invoked to load a file from suspicious user-writable directories (such as AppData, Temp, Downloads, or Desktop). This activity is indicative of potential proxy execution of malicious code, a technique often used to bypass application whitelisting.
Detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfers, specifically targeting non-Microsoft signed processes. Adversaries often abuse the Background Intelligent Transfer Service (BITS) to download malicious payloads or exfiltrate data, as it is a legitimate Windows service that operates in the background.
This rule detects attempts to add a file or path exclusion to Microsoft Defender using the WMI command-line tool (wmic.exe/wmice.exe). This is a known defense evasion technique used by malware to prevent detection.
Detects the 'node' process creating hidden JavaScript or native loader files (e.g., .js, .node, .so, .dylib, .bin) in user profile or temporary directories. This activity is indicative of the OpenClaw malware's staging phase, where it drops its components for persistence or further execution.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
Detects HTTP responses containing JavaScript files with a Content-Length exceeding 1MB. This behavior is associated with the Bluekit PhaaS (Phishing-as-a-Service) platform, which uses large, obfuscated JavaScript bundles for browser fingerprinting and to evade static security signatures.
Detects the use of the 'chmod' command to modify file permissions on critical system directories or files such as /etc/passwd, /etc/shadow, and various log directories. This activity is often indicative of an adversary attempting to facilitate privilege escalation, maintain persistence, or hide malicious artifacts.
Detects suspected Browser-in-the-Middle (AiTM) activity by identifying successful multi-factor authentication followed by session activity from a different source IP address or with a different user-agent string within a 10-minute window, suggesting token theft or session hijacking.
Detects Pony malware dropping a self-deletion batch script into %TEMP% via ShellExecuteA, then executing it with cmd.exe. The batch loops using 'if exist %1 goto' until the loader file lock is released, deletes the loader, then deletes itself with 'del %0'. Correlates .bat file creation in TEMP with subsequent cmd.exe execution of that same file on the same device.
This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.
Detects the Miasma worm propagating through CI/CD pipelines by identifying unauthorized updates to GitHub Actions workflow files. Specifically monitors for modifications to workflows under the LeoPlatform or LeoInsights projects by the compromised user 'czirker', with signs of weaponization such as the addition of OIDC id-token write permissions and npm-publish capabilities.
Detects the execution of malicious .NET assemblies associated with the Turla group's STOCKSTAY malware family. The rule identifies specific file names (ClientMNGR2.exe, GR3.exe) and known SHA256 hashes indicative of these assemblies, which utilize the K1MORPHER string obfuscation technique.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation. This behavior is indicative of an attacker using a stolen device code to register a new device, thereby gaining persistent access to the user's account.
Detects anomalous logins (impossible travel/session anomalies) utilizing the Kali365 Live desktop application User-Agent combined with IP shifting. This rule identifies instances where a user logs in with the 'kali365-live/1.0.0' User-Agent from an IP address different from a previous successful login by the same user within a 4-hour window, where the previous login used a different User-Agent.
Detects sign-ins utilizing the Kali365 Live desktop application User-Agent, which is associated with the EvilTokens threat actor tooling. This rule specifically looks for the User-Agent string "kali365-live/1.0.0" in sign-in logs.
Detects malicious GitHub Actions workflow activity characteristic of the Miasma worm. The rule monitors for the creation or update of workflows named 'Dependabot Updates' (masquerading), which utilize OIDC token write permissions and execute scripts using 'bun run _index.js', often on suspicious snapshot branches.
Detects various methods of establishing persistence on Linux systems by abusing dynamic linker configuration (/etc/ld.so.preload), modifying shell startup profiles (.bashrc, .profile) to include malicious environment variables (LD_PRELOAD/LD_LIBRARY_PATH), or directly launching processes with these hijacked variables pointing to suspicious locations such as /tmp, /dev/shm, or /var/tmp.
Detects execution of a Python runtime loading a compiled bytecode file disguised with a '.cat' extension, a key defense evasion technique of NarwhalRAT.
Detects malicious payloads downloaded from a spoofed legitimate domain (e.g., downloading "update.exe" from a hijacked google.com). This rule specifically looks for 'google.com/update.exe' or 'microsoft.com/flash_update.exe' within the RemoteUrl field, indicating a potential attempt to deliver malicious software from a compromised or spoofed legitimate domain.
Page 369 of 864