Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the payload cleaning up its tracks by recursively deleting the .laravel_locale temporary artifacts directory after exfiltration.
Detects a legitimate, signed Microsoft binary being programmatically copied out of System32 into C:\Users\Public via cmd.exe to prepare the DLL sideloading staging ground. This activity is associated with the Nimbus Manticore threat actor.
Correlates the Python loader process interacting with the hardcoded named pipe \pipe\PipePipe! used to buffer shellcode into memory.
Identifies rundll32.exe executing payloads where the exported function name is highly anomalous (over 10 characters, randomized alphanumeric), typical of packed loader DLLs.
Identifies process hollowing by detecting svchost.exe spawned without the mandatory -k parameter, a direct indicator of the Showboat loader injecting its telecom-targeting payload.
Detects the Python interpreter executing with a command line containing a specific string fingerprint ('lzcdrtfxyqiplpd') associated with the Glassworm obfuscation variant. This indicates potential obfuscated code execution.
Detects Python command lines that exhibit patterns indicative of Kramer obfuscation, specifically looking for the presence of 'import', 'base64', 'ctypes', and 'eval' keywords. This combination suggests an attempt to obfuscate malicious code within a Python script, often used for dynamic loading and execution of payloads.
Detects the sideloading of 'msvcp140.dll' or 'mscoree.dll' when loaded from a 'ProgramData' directory that does not contain 'Microsoft' in its path. This pattern is indicative of an adversary attempting to execute malicious code by placing a malicious DLL in a location where a legitimate application will load it, bypassing standard security controls.
Detects the legitimate Microsoft .NET build component MSBuild.exe initiating outbound network connections to public IP addresses. This activity is a known LOLBin technique for establishing command and control (C2) or exfiltrating data. Threat actors have been observed abusing MSBuild.exe for host reconnaissance data exfiltration and C2 communications.
Detects the creation or modification of a local VSCode workspace extension (package.json) that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting 'skipPublisherTrust' to true. This technique is used to bypass VSCode's publisher trust mechanisms and silently install malicious extensions.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Detects AppCertDlls registry key modification for persistent DLL injection
Detects attempts to escalate privileges via sudo
Detects abuse of Active Directory Certificate Services for credential forgery
This rule detects the staging of 'NotepadPlusPlus.dll' within the '%APPDATA%\Microsoft\Windows' directory, potentially indicating a Clickfix attack. The presence of 'Start-Process' in conjunction with these strings further strengthens the detection.
This rule detects repeated failed or successful logon attempts (EventID 4625 or 4624) to sensitive system accounts like 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', or 'ADMIN$' from non-system accounts. It specifically looks for interactive (LogonType 10), remote interactive (LogonType 3), or unlock (LogonType 9) logons, and triggers if there are 3 or more such attempts within an hour for the same account and computer.
This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
This rule detects suspicious access attempts to file system objects (hard disk volumes or DOS devices) by non-system accounts. It specifically looks for Event ID 4656 (Handle to an Object was Requested) where the ObjectName contains "\Device\HarddiskVolume" or "\DosDevices\", the AccessMask indicates broad access (0x1fffff or 0x120089), and the SubjectUserName is not a standard system account (SYSTEM, LOCAL SERVICE, NETWORK SERVICE). The rule then aggregates these events over one-hour intervals and flags if five or more such access attempts occur from the same computer and user.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
This rule detects the presence of executables with names commonly associated with legitimate Windows system processes (e.g., system32.exe, winlogon.exe, svchost.exe) but located in non-standard directories outside of 'System32' or 'syswow64'. This behavior is indicative of masquerading, where an attacker attempts to hide malicious executables by naming them after legitimate system processes and placing them in unusual locations to evade detection.
Page 421 of 864