Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects highly obfuscated VBScript execution utilizing specific array splitting and character decoding loops used by GammaDrop. The rule specifically looks for the combination of 'Split' and 'ChrW' functions within VBScript command execution, which is indicative of a common obfuscation technique used by the Gamaredon APT group.
Detects the iterative XOR decryption routine signature used to decode the Donut payload in memory prior to execution, specifically looking for large memory write operations initiated by 'setup.exe'.
Correlates suspicious Temp directory creation with immediate wallpaper registry modifications, a common pattern for Makop ransom notes.
Detects the execution of a 64-character hex-named executable using the 'i=' parameter for potential process injection or tracking, indicative of Makop Ransomware activity.
Parses BITSAdmin command lines to detect the stealthy download of the secondary loader, specifically looking for arbitrary extensions being renamed to .dll upon completion.
Correlates processes executing from the Public directory utilizing VirtualAllocEx to allocate PAGE_EXECUTE_READWRITE memory, a precursor to process hollowing.
Detects a binary masquerading as an 18-digit executable in LocalAppData executing curl-specific arguments (-s -L -o) to download a .pdf file (actually the Python RAT archive).
Detects MsBuild.exe loading memory-resident .NET assemblies post-hollowing.
Detects malware modifying memory protections to hook AccessCheckByType to force access success.
Identifies execution of the primary Hindi-named loader ('कर विवरण') used in the TaxShadow campaign.
This rule detects the use of 'chmod' or 'chown' commands on critical system directories ('/etc', '/bin', '/usr', '/sbin') on Cisco vManage, vSmart, and vEdge networking appliances. Such activity could indicate unauthorized modification of system files, persistence attempts, or privilege escalation by an adversary targeting the networking infrastructure.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects AutoHotkey scripts injecting into legitimate .NET binaries for defense evasion, specifically targeting processes associated with AsyncRAT. The rule looks for AutoHotkey.exe or command lines containing '.ahk' initiating processes that are known .NET binaries like AddInProcess32.exe, AppLaunch.exe, or aspnet_compiler.exe.
Detects indicators of the MYRA Linux RAT, including fileless execution via memory-based techniques (memfd_create/fexecve), process masquerading as systemd-userdbd, and persistence mechanisms leveraging LD_PRELOAD and malicious cron jobs.
Detects a multi-stage infection sequence characteristic of common IoT botnets (such as Mirai variants). The detection triggers when a sequence of events occurs on the same device within a 5-minute window: downloading a file from a URL using wget or curl to /tmp/, modifying the file permissions using chmod 777, and subsequently executing the binary. An optional cleanup phase involving removal of files from /tmp/ is also correlated.
Detects Key Vault access policy or role changes that grant secret-reading capabilities.
Detects disabling of Conditional Access policies via Graph API
Detects administrative mail, forwarding, or content compliance rule changes performed from an IP address classified as an anonymous proxy. This behavior is often associated with threat actors like UNC6508, who use obfuscation networks and proxies to access administrator accounts and exfiltrate data.
Detects deletion of a phishing-resistant authentication method followed by registration of a less secure phone or software token method for the same account.
Detects access to App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations.
This rule detects suspicious process execution patterns on Linux systems, specifically looking for processes running from anonymous memory mappings (memfd), execution via /proc/self/fd (fexecve pattern), and processes masquerading as 'systemd-userdbd' from unexpected file paths. These techniques are often used by adversaries for evasion and persistence.
Page 398 of 864