Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
Detects the execution or presence of distinct, custom red-teaming utilities and EDR evasion tools favored by The Gentlemen threat actors. This rule identifies specific filenames and command-line arguments associated with these tools.
This rule detects attempts by a process, potentially a Remcos RAT loader identified by 'GST*.com' or 'GST' in its command line, to evade sandbox or virtual machine environments. It looks for the presence of common sandbox/VM indicators in the command line.
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Detects potential privilege escalation attempts by the Remcos RAT loader using token impersonation. The rule looks for process command lines containing keywords related to token manipulation ('impersonate', 'token', 'duplicate', 'SeImpersonate', 'logon') specifically when the initiating process is identified as 'Remcos'.
Detects the use of .NET Reflection methods (System.Reflection, Activator.CreateInstance, InvokeMember, MethodInfo) by processes named 'GST*.com' or 'Optimax.dll'. This behavior is indicative of obfuscation techniques often employed by malware, specifically associated with the Remcos RAT loader in this context.
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific pattern targets the Miasma Alpine container payload.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
This rule detects attempts to bypass User Account Control (UAC) using specific Windows executables (eventviewer.exe, fodhelper.exe, computerdefaults.exe, slui.exe) initiated by cmd.exe or powershell.exe. The rule specifically looks for these executables being run from non-standard system directories, indicating a potential UAC bypass technique often observed after an initial compromise, such as via RDP.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
Detects command-line activity indicative of timestomping, specifically when 'cmd.exe' is used with file copy/move commands ('copy', 'xcopy', 'robocopy', 'move') and the target path is not within 'Program Files' or 'Windows' directories. This behavior is often associated with ransomware like Prinz Eugen attempting to hide its activities.
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
This rule detects the creation or modification of executable files (.com, .exe, .scr, .pif, .bat, .cmd) in common user directories (Documents, Downloads, Desktop) where the initiating process is a legitimate application like explorer.exe, winrar.exe, or 7z.exe. This pattern is often used in phishing attacks where malicious executables are disguised as benign documents.
This rule detects the execution of 'cmd.exe' with command-line arguments indicative of file deletion, specifically targeting files or directories commonly associated with ransomware activity or anti-forensics. The rule looks for deletion commands ('del', 'erase', 'remove', 'delete') combined with specific file paths or executables ('servertool.exe', 'encrypt.exe', 'Music\', 'Desktop\'). This behavior is often observed in ransomware attacks to remove traces or critical files.
Detects disabling of Windows Event Log service
Detects the execution of powercfg.exe to modify standby timeouts. Attackers may disable sleep modes to ensure continuous execution of malicious payloads, such as credential loggers, and maintain uninterrupted remote access.
Detects manual mapping of SbieDll.bin into memory.
Identifies sideloading of endpointdlp.dll by legitimate Microsoft Defender binary mpextms.exe.
Detects the infostealer disabling ETW and AMSI by setting the m_enabled flag to 0 in memory.
Detects execution of a SimpleRunPE-style loader from Downloads, Temp, AppData, or Public paths.
This rule detects suspicious administrative activities in Azure AD, Microsoft Graph, SharePoint, Exchange, or Teams when performed by accounts that are not explicitly identified as 'admin' or 'service' accounts. It looks for a combination of at least 5 operations and 2 unique operation types within a 2-hour window, targeting group, application, or service principal related resources. This could indicate an attacker using compromised non-privileged accounts to perform administrative actions or escalate privileges.
Page 415 of 864