Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the initialization of the NetQosCim provider via WMI, which threat actors can use to silently throttle EDR telemetry without terminating the agent.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.
Detects the use of certutil.exe with command-line arguments indicative of downloading files from a URL or decoding/encoding data. This utility is often abused by adversaries for ingress tool transfer or obfuscation.
Detects the Pony malware credential harvesting sequence where a non-system process performs repeated interactive logon attempts (LogonUserA dictionary brute force via NetUserEnum) against local accounts and achieves at least one successful logon, after which LoadUserProfileA is used to impersonate the compromised account and harvest profile-scoped credentials.
Detects rundll32.exe executing a DLL calling the 'Begin' export function, which is associated with the ErrTraffic malware. The rule specifically looks for rundll32.exe processes with command-line arguments containing 'Begin' and hidden window parameters like '-Window Hidden' or '-WindowStyle Hidden'.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Hunting rule: correlate with additional signals before alerting. Detects PowerShell FileStream open on \\.\<volume> to read raw boot sector bytes.
Detects Microsoft Authentication Broker (MAB) accessing enterprise applications outside of the expected first-party subset. This could indicate an attempt to bypass multi-factor authentication (MFA) or gain unauthorized access to resources.
Detects unsigned Go-compiled executables (lacking product/company info and certificate) executing from user-writable paths like %TEMP%, %APPDATA%, %PUBLIC%, or %PROGRAMDATA%\<user>\Temp. This behavior is associated with the Backdoor.Turn malware, which is compiled in Go.
Correlates Run Command execution with immediate subsequent Defender Antivirus tampering on the endpoint. This rule detects attempts to disable or modify Microsoft Defender Antivirus settings using PowerShell commands like 'Set-MpPreference' or 'DisableRealtimeMonitoring' when initiated by 'RunCommandExtension.exe'. This activity is indicative of an attacker attempting to impair defenses.
Detects the exchange of FOCI refresh tokens across the Microsoft app family, a tactic utilized by Tycoon 2FA. This KQL query identifies successful sign-ins where a single user's session (CorrelationId) interacts with more than 3 distinct applications within a 5-minute window, indicating potential token abuse.
Detects anomalous access to Privileged Access Management (PAM) platforms (e.g., CyberArk, BeyondTrust, Delinea, HashiCorp Vault, Thycotic, ARCON PAM). The rule identifies successful sign-ins occurring outside typical business hours (7 AM to 7 PM) that also exhibit either a high volume of sign-ins (more than 5 per hour per user/app) or access from multiple new IP addresses (more than 2 unique IPs per hour per user/app). This behavior is indicative of potential abuse of privileged accounts, possibly by threat actors like Silk Typhoon (HAFNIUM).
Detects sign-ins to Entra ID using Axios, Undici, or Node-Fetch user agents, which are fingerprints of Tycoon 2FA attacks. This rule helps identify potential multi-factor authentication bypass attempts.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Page 409 of 864