Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects suspicious commits pretending to be the Claude AI bot but pushing dependency updates, a tactic Miasma uses to blend in with legitimate automated pull requests.
Detects the execution of 'memdump', a utility that captures physical or process memory, indicating potential memory scraping activity.
This rule detects the execution of 'cmd.exe' with command-line arguments indicative of file deletion, specifically targeting files or directories commonly associated with ransomware activity or anti-forensics. The rule looks for deletion commands ('del', 'erase', 'remove', 'delete') combined with specific file paths or executables ('servertool.exe', 'encrypt.exe', 'Music\', 'Desktop\'). This behavior is often observed in ransomware attacks to remove traces or critical files.
Detects the Print Spooler service (spoolsv.exe) spawning svchost.exe. This behavior is leveraged by the WIN_PLUS variant of SprySOCKS to execute a first-stage print processor loader, which then injects the backdoor into a newly created svchost.exe process.
Detects the creation or execution of a file named 'agt.dll' within a masqueraded 'CorsairUtil' directory, a defense evasion tactic used by the Vidar Turb00 campaign. This rule monitors both file drops (DeviceFileEvents) and DLL loads (DeviceImageLoadEvents) for the specific path and filename combination.
Hunting rule: correlate with additional signals before alerting. Detects PowerShell FileStream open on \\.\<volume> to read raw boot sector bytes.
Detects pcalua.exe used as a LOLBin to proxy the execution of mshta.exe, which is a known technique for adversaries to execute malicious code (Potemkin/ClickFix). The rule specifically looks for pcalua.exe executing with command-line arguments that include both '-a' and 'mshta.exe'.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
Detects attempts to disable Windows Defender features by modifying specific registry values. This rule looks for changes to registry keys under `\Policies\Microsoft\Windows Defender` where values like `DisableAntiSpyware`, `DisableRealtimeMonitoring`, `DisableBehaviorMonitoring`, or `DisableIOAVProtection` are set to '1', indicating an attempt to disable these security features.
Detects the execution of RegSvcs.exe initiated by a VBScript (wscript.exe or cscript.exe). This technique can be used by adversaries to bypass application control and execute malicious code.
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
This rule detects the execution of 'eventviewer.exe' by scripting engines such as 'wscript.exe', 'cscript.exe', or 'vbscript.exe'. This behavior is indicative of a User Account Control (UAC) bypass technique where 'eventviewer.exe' is abused to elevate privileges without user interaction.
Detects the removal of known Amos Stealer staging artifacts, specifically the 'osalogging.zip' file or 'sync' directories within the /tmp folder. This behavior indicates post-exfiltration cleanup to evade detection.
Detects the execution of RegSvcs.exe initiated by a VBScript (wscript.exe or cscript.exe). This technique can be used by adversaries to bypass application control and execute malicious code.
Detects 1027 test "Execute base64-encoded PowerShell from Windows Registry" (Obfuscated Files or Information) using command-line and process indicators derived from executor behavior.
Detects exploitation of application vulnerabilities for denial of service
Detects local account RDP logins originating from external IP addresses
Detects use of Forfiles for indirect command execution to evade detection
Detects malicious ClickOnce application manifests for proxy code execution
This rule spots signed fake AI software that launches trusted Windows utilities in unusual ways to hide malicious activity. Attackers abuse built-in tools so security software trusts the chain. Examine the parent installer and child commands. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
Page 416 of 864