Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,654
12,601
8,412
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the creation or modification of specific SharePoint policy pages DLL files (microsoft.office.policy.pages.dll) that are known to be vulnerable to CVE-2026-45454. The detection is based on matching the SHA256 hashes of these vulnerable DLL versions. This indicates the presence or manipulation of a vulnerable component within a SharePoint environment.
Detects execution of New-NetQosPolicy in PowerShell, indicative of EDRChoker QoS throttling, which can be used to impair defenses.
Identifies string splitting techniques used in Dropping Elephant downloaders to evade static PowerShell logging. The rule specifically looks for obfuscated substrings like 'iw''r', 'g''c''i', 'r''e''n', 'c''p''i', and 'g''cm sch' within PowerShell command lines.
Detects PHP or web server processes launching interpreters with encoded, Base64-decoded, or dynamically evaluated command content. This behavior is often indicative of web shell or backdoor execution. The rule specifically looks for web server processes (e.g., php.exe, w3wp.exe, httpd, nginx) as initiating processes, which then launch command interpreters (e.g., cmd.exe, powershell.exe, bash, python) with command lines containing obfuscation techniques like -EncodedCommand, FromBase64String, base64 -d, eval(), exec(), IEX, or Invoke-Expression.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects PowerShell command lines attempting to disable AMSI (Antimalware Scan Interface) by leveraging 'AmsiUtils' and 'amsiContext'. This technique is often used by adversaries to evade security controls that rely on AMSI for script scanning.
Detects attempts to bypass User Account Control (UAC) by launching specific Windows applications (eventvwr.exe, fodhelper.exe, computerdefaults.exe, slui.exe) that can auto-elevate, when initiated by cmd.exe or powershell.exe. This rule specifically excludes executions from standard system directories (system32, syswow64) to reduce false positives from legitimate system operations.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects the creation, modification, or renaming of files with the '.prinzeugen' extension, which is commonly associated with ransomware activity. The rule aggregates these events by device and time, alerting if 10 or more such files are observed within an hour, indicating potential widespread encryption.
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
Targets rundll32 calling a Begin export from a DLL staged in Temp or AppData. The UDM rule retains principal and target context for correlation.
This rule detects attempts to inject shell metacharacters or command substitution into JSON associated with a 'start vnc' operation within FortiSandbox. It specifically looks for patterns indicative of command injection vulnerabilities in network events, either in the event_sub_type or action_remote_ip fields. The rule aims to identify malicious activity targeting FortiSandbox, potentially leveraging a vulnerability like the one described in FG-IR-26-141.
This rule detects attempts to abuse Windows Defender Application Control (WDAC) policies, specifically looking for the execution of 'RefreshPolicy.exe' or PowerShell commands containing 'Merge-CIPolicy'. This activity is associated with the Interlock threat group, which is known to drop custom WDAC policies to allow their tooling and block EDR components.
This rule detects suspicious execution of rundll32.exe by the Tomb crypter, which is known to unpack and execute malicious DLLs. The detection logic specifically looks for rundll32.exe processes where the command line ends with ",rundll" and the executable is located in common temporary or public user directories such as AppData\Local\Temp, ProgramData, or Users\Public. This pattern is indicative of the Interlock/Rhysida ransomware ecosystem.
This rule detects the creation or loading of a .sys file (kernel driver) within the Windows Fonts directory by a non-standard loader. This behavior is suspicious as the Fonts directory is not a typical location for kernel drivers, and the use of common command-line interpreters (cmd, powershell, pwsh, rundll32, regsvr32) or other executables to stage or load such files indicates potential malicious activity, possibly related to defense evasion or persistence.
This rule detects instances where mshta.exe is used to execute a remote resource with a .7z file extension. This behavior is often indicative of an adversary attempting to bypass traditional security controls by disguising malicious script content as a compressed archive, as observed in some malware distribution campaigns.
Detects the rapid compilation of code via csc.exe, gcc.exe, or vbc.exe immediately following an outbound network connection to an LLM API (specifically api.openai.com), indicating AI-assisted malware generation on-the-fly. The rule joins network events showing a connection to OpenAI's API with process creation events for compilers within a two-minute window on the same device.
Page 392 of 864