Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects msiexec.exe silently downloading and installing an MSI payload from an external URL. This behavior is often indicative of malicious activity where an attacker uses msiexec to fetch and execute a malicious installer without user interaction.
Detects evidence of Donut shellcode execution by monitoring 'mscoree.dll' image loads initiated by Python processes. Donut is an open-source tool used to generate position-independent shellcode, often for injecting malicious payloads into memory. This rule specifically looks for scenarios where Python is used as the initiating process for loading the .NET runtime library 'mscoree.dll', which can be indicative of Donut shellcode execution.
Monitors for the empty DelegateExecute value insertion that forces Windows to fall back to legacy COM handler resolution, as observed in Operation SilentCanvas.
Detects the writing and subsequent deletion of Azure SQL firewall rules, a technique used to enable remote access and evade defenses. This behavior could indicate an adversary attempting to open up network access to an Azure SQL server and then remove the evidence of the rule change.
Detects modification of Azure Storage Account network access rules, specifically when the 'networkAcls' property is changed. This could indicate an attempt to enable public access from specific IP addresses, potentially exposing the storage account to unauthorized access.
Detects sign-ins to M365 using the default Node.js user agent, indicative of the Tycoon 2FA kit relay tier.
Detects a recently downloaded utility executable loading autorun.dll from the same writable directory, consistent with DLL side-loading. This behavior is often associated with malware attempting to establish persistence or elevate privileges by abusing legitimate applications.
Detects the creation, renaming, or modification of 'vcpktsvr.exe' and 'libcef.dll' within a directory path containing '\vcpacket'. The rule specifically looks for the co-occurrence of both files within a 10-minute window on the same device, indicating the presence of the Windows ZiChatBot malware stage, which is known to use DLL side-loading.
Detects the creation of scheduled tasks using `schtasks.exe` that include encoded PowerShell commands or base64 strings in their actions. This rule specifically looks for the use of `-EncodedCommand`, `-enc`, `-e`, `powershell`, `FromBase64String`, `IEX`, `Invoke-Expression`, and paths like `AppData`, `Temp`, or `ProgramData` within the command line, which are indicators of the PRISMEX implant used by APT28 for persistence.
Detects .NET processes creating a high volume of files with random 4-character extensions, excluding common temporary and log files. This behavior is indicative of the Chaos ransomware, which MuddyWater has used as a distraction for espionage.
Okta Impossible Travel Detection
Cortex XDR
Detects when a single user successfully authenticates to Okta from two different countries within a two-hour window, indicating potential impossible travel which could be a sign of a compromised account.
Detects the execution of a process named 'userscreen.exe' that is actually a masqueraded 'pythonw.exe', a technique used by APT37 NarwhalRAT. Detecting the masqueraded Python execution is critical for stopping NarwhalRAT before it can load its fileless payload into memory.
Detects the use of the Windows built-in 'tar' utility to extract files into the C:\Users\Public\AccountPictures directory. This behavior has been observed in APT37 NarwhalRAT campaigns during its setup phase, indicating potential ingress tool transfer or staging of malicious files.
Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.
Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.
Detects the creation of generic executable files (e.g., me.exe, update.exe, monitor.exe, service.exe) within the Hola browser installation path. This rule aims to identify potentially malicious executables delivered by a compromised updater or supply chain attack targeting Hola browser users. The rule also captures the principal process responsible for the file creation for correlation.
Detects the loading of 'tpsvcloc.dll' from the 'Windows Fonts' directory by a ThinPrint-related signed host. This behavior is indicative of potential DLL side-loading or hijacking, as 'tpsvcloc.dll' is typically associated with ThinPrint software and should not be loaded from the Fonts directory. The rule focuses on identifying this specific anomalous module load event.
This rule detects the execution of self-extracting archives (SFX) that are commonly used by malware to launch a visible decoy and a hidden executable from a temporary directory. It specifically looks for process launch events where the command line contains keywords associated with SFX archives (e.g., '7-zip', 'sfx', '-y', '-o') and the principal process's file path contains terms like '7z', 'sfx', 'setup', or 'installer'. The rule aims to identify the initial stage of an attack where an SFX archive is used to drop and execute malicious payloads.
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
Detects suspicious Python process execution that combines network socket creation with memory manipulation imports (ctypes/mmap) or shellcode-like hex byte strings in the command line. This behavior is indicative of in-memory exploit delivery or staging, often used by adversaries to execute malicious code without writing it to disk. The rule also looks for inline Python execution (-c) with similar indicators.
Detects EvilTokens phishing HTML page with AES-GCM encrypted payload by file hash and characteristic code patterns
Page 424 of 864