Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects accounts with first-time RDP logins to multiple systems (3 or more) within a short time window (30 minutes or less). This behavior is indicative of lateral movement, often seen after initial access via stolen VPN credentials, as observed with the Akira ransomware group.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
This rule detects the execution of mshta.exe with a command line that includes a remote fetch to 'abimj.edu.af/index.php'. It then correlates this activity with subsequent child process spawning, indicating potential malicious activity associated with the Operation XENOFISCAL campaign.
Detects mshta executing the malicious URL/HTA but wrapped with caret (^) obfuscation typical of SideCopy.
Detects Microsoft Word making an outbound network connection and subsequently spawning the Equation Editor process (EQNEDT32.EXE). This behavior is associated with the exploitation of CVE-2017-11882 via a malicious remote template.
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns, where a file with a .ini extension is used for execution, often via cmd.exe.
Detects modifications to the .vscode/extensions.json file which may be used by attackers to recommend malicious extensions to victims opening the workspace. Attackers can abuse this in conjunction with automated keystrokes to bypass warnings and force extension installations.
Detects execution of PowerShell with encoded commands, often used in malicious scripts.
Identifies login attempts from RedVDS infrastructure IPs deliberately utilizing legacy authentication protocols (IMAP/POP3) to bypass Modern Authentication Conditional Access policies.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for paths matching the regex `(?i)\AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\"` and excludes common browser executables like chrome.exe, msedge.exe, and update.exe to reduce false positives.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects suspicious command-line activity indicative of direct kernel object manipulation, often associated with kernel-mode rootkits. It looks for processes executing commands containing keywords related to direct kernel access (e.g., 'directl', 'kernel call', 'ntoskrnl', 'hal.dll') in conjunction with keywords suggesting privilege escalation or driver loading (e.g., 'setprivileges', 'loaddriver', 'createremotethread'). Such combinations can signify attempts to install or interact with malicious kernel drivers or rootkits.
This rule detects suspicious activity involving the creation or update of managed identities and the assignment of highly privileged roles (Contributor, Owner, User Access Administrator) to them. It specifically looks for multiple such assignments within a one-hour window to managed identities associated with automation, runbook, or function resources, indicating potential privilege escalation or malicious access.
Detects potential privilege escalation attempts by the Remcos RAT loader using token impersonation. The rule looks for process command lines containing keywords related to token manipulation ('impersonate', 'token', 'duplicate', 'SeImpersonate', 'logon') specifically when the initiating process is identified as 'Remcos'.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Detects the polymorphic script's initial action: patching the AmsiScanBuffer to prevent Defender from catching the subsequent payload. This rule specifically looks for PowerShell commands containing 'amsiInitFailed' or 'AmsiScanBuffer', which are indicators of attempts to bypass AMSI.
Detects a persistent module loading a previously unseen DLL from its task or plug-in directory after local IPC activity. This behavior is associated with the Kazuar malware.
Detects the Vidar cleanup phase where it spawns a ping delay loop followed by self-deletion (del) of the AutoIt executable using cmd.exe.
Page 413 of 864