Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Detects the use of the 'netsh' utility to add 'allow' or 'bypass' rules to the Windows Advanced Firewall. This behavior is frequently used by adversaries to facilitate persistence or lateral movement by opening network ports while bypassing existing security controls.
This rule monitors for suspicious child processes (like cmd.exe, powershell.exe, wscript.exe, or rundll32.exe) spawned by dllhost.exe. Dllhost.exe is typically a legitimate Windows process for COM object hosting, and it spawning command-line interpreters or administrative utilities is often indicative of malicious activity, such as process injection or lateral movement.
Detects the creation of BITS jobs using PowerShell that initiates a connection to an external network location, excluding known Microsoft domains. This behavior is often associated with the use of BITS for downloading arbitrary files or tools from non-trusted sources, which is a common technique used in ingress tool transfer.
Detects modifications to Windows Registry keys commonly associated with COM hijacking. Attackers modify these keys to redirect legitimate system calls to malicious executables, achieving persistence and potential privilege escalation. This rule monitors for registry value creation or modification in keys related to shell open commands for MS-settings, MSC files, or executables.
Detects the use of PowerShell commands that modify file system metadata (e.g., CreationTime, LastWriteTime, LastAccessTime). This technique, often referred to as 'timestomping', is used by adversaries to manipulate file timestamps to evade detection or hide activity.
Detects modification of a storage account network rule set to allow public access, bypass trusted-service checks, or add broad network ranges.
Detects the creation of a randomly named .ocx file in temporary directories (AppData\Local\Temp or Windows\Temp) followed by its loading by a process. This behavior is indicative of OXLOADER malware staging shellcode, where 'dui70.dll' is often copied and renamed to a .ocx file. Exclusions are in place for common legitimate processes like msiexec.exe and regsvr32.exe.
Detects the loading of DLLs named 'Optimax.dll' or 'System Optimizer Ultimate.dll', which are associated with potentially unwanted programs (PUPs) or malicious software. The rule also identifies a specific malicious hash for 'Optimax.dll'.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
Detects the use of attrib.exe with the '+h' flag to hide files or directories within common user-specific folders such as AppData, Temp, or Roaming. This activity is often associated with adversaries attempting to conceal their presence or malicious files.
Detects attempts to bypass User Account Control (UAC) using fodhelper.exe or eventvwr.exe. This rule specifically looks for these processes initiating other processes with 'High' or 'System' integrity levels, where the initiated process is not fodhelper.exe or eventvwr.exe itself. This behavior is indicative of UAC bypass techniques.
This rule detects EvilTokens device code OAuth phishing by identifying rapid, repeated POST requests to the /common/oauth2/token endpoint with a device_code grant and authorization_pending responses, followed by a successful token issuance and sign-in without an MFA claim. This pattern is consistent with EvilTokens session harvesting.
Detects potential Pass-the-Hash lateral movement where a single account uses NTLM authentication as a local administrator to access three or more distinct devices within a 30-minute window, a pattern often indicative of automated credential propagation.
Detects modifications to the Windows Defender exclusion list via registry keys. Adding exclusions can be used by attackers to hide malicious files, processes, or directories from antivirus scanning.
Detects successful user sign-ins from a country that has not been observed in the user's sign-in activity over the past 30 days. This baseline helps identify potentially compromised accounts by surfacing geographic anomalies.
Detects G2M.exe making external connections shortly after loading a local g2m.dll, providing behavioural confirmation that the trusted binary has been repurposed. This rule specifically looks for network activity from G2M.exe when its process image path is located in suspicious directories like AppData, Temp, Downloads, ProgramData, or Users\Public, indicating potential abuse of a legitimate application.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Detects Vidar Stealer's technique of bypassing Chrome's Application-Bound Encryption by spawning a suspended Chrome instance with specific command-line flags for APC-based CryptUnprotectMemory injection, combined with accessing Chrome credential files (Login Data, Cookies, Local State) for cookie and password theft. This rule correlates process creation events of Chrome with suspicious command-line arguments and file access events to Chrome's credential stores by the same initiating process within a short time frame.
Detects the clearing of Windows Security and System event logs, or Defender XDR audit logs, indicating potential adversary activity to remove traces of their actions.
Detects various indicators associated with the SilverFox loader deploying the Sauron RAT, including registry markers, service creation, self-copying of svchost.exe, specific marker file artifacts, and known C2 communication.
Page 388 of 864