Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects fragmented string reconstruction techniques within PowerShell memory targeting IWR (Invoke-WebRequest) or IEX (Invoke-Expression). This rule specifically looks for PowerShell process command lines containing 'IWR' or 'IEX' with fragmented string obfuscation (e.g., I['']w['']r).
Correlates the registry hijack of ms-settings with the auto-elevated execution of ComputerDefaults.exe and payload generation, indicative of a UAC bypass technique used by SilentCanvas.
This rule detects the execution of ScreenConnect, a remote access tool, directly spawned by ComputerDefaults.exe. This behavior is indicative of a UAC bypass technique, specifically observed in the 'Operation SilentCanvas' campaign.
Identifies downstream ClickFix where users paste and execute PowerShell or CMD commands via the Explorer Run menu, specifically looking for commands that include Invoke-WebRequest, IEX, or mshta, and are associated with network connections to 'wigetticks.com' or 'wizzleticks.com'.
Detects browser network events fetching secondary stage loaders from api.wizzleticks.com, specifically when initiated by cmd.exe, powershell.exe, or mshta.exe. This indicates a potential supply chain attack where a legitimate process is used to download and execute malicious content.
Detects mshta.exe downloading malicious HTA logic from the 'wizzleticks.com' domain. This activity is often associated with initial access or execution phases of an attack, where mshta is abused to fetch and execute remote scripts or HTA files.
Detects the loading of a compromised JavaScript file from a CDN (cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews.js) followed by the execution of mshta.exe on the same device within a 10-minute timeframe, indicating a potential supply chain attack by SmartApeSG.
This rule looks for adding a passwordless sudo rule for a CI runner account on Linux. Attackers who gain runner access can then become root freely. Remove the rule and audit runner images. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
SniperDz VAPID Key Activity
Cortex XDR
Detects web requests or command line activity containing the specific VAPID public key associated with the SniperDz push-notification infrastructure. This key is known to be used by the SniperDz PhaaS (Phishing-as-a-Service) ecosystem.
Detects network connections or DNS queries to the specific link-aggregation domain 'fanlnk.to'. This domain is known to be abused by the threat actor SniperDz to mask the destination of malicious social media lures, often leading to phishing or malware delivery.
This rule detects when a GitHub workflow branch is deleted shortly after build artifacts were downloaded. This behavior can indicate an attacker attempting to hide their tracks after exfiltrating secrets or sensitive information from build artifacts. It is crucial to preserve logs and investigate who deleted the branch. Further investigation should include questioning the user about recent software installations or clicked links, and involving the security team if the answers are unclear.
Correlates the file creation of zuidrt.hta and its execution via mshta.exe, indicating potential malicious activity associated with Operation XENOFISCAL.
Correlates mshta.exe (post-HTA load) spawning PowerShell to execute secondary stages like the .vmxx shellcode, as observed in Operation XENOFISCAL.
This rule detects network connections to the 185.235.137.0/24 subnet, which is associated with XenoRAT command and control (C2) infrastructure. The detection specifically looks for these connections being initiated by 'mshta.exe' or 'powershell.exe', indicating potential malware activity or C2 communication.
Detects common Windows API function names associated with process injection in command lines.
Vapt Framework Markers
YARA-L
Detects the unique start and end markers (VAPTb3gin, VAPTfin) used by the VAPT autonomous framework to confirm exploit success across network or host logs.
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific sequence involves echoing 'runner ALL=(ALL) NOPASSWD:ALL' into a file within the /mnt/runner directory and then changing its permissions to 0440, indicative of a privileged modification to the sudoers file within a containerized GitHub Actions runner environment.
Detects the execution of 'netsh.exe', 'sc.exe', or 'powershell.exe' with command-line arguments indicative of enabling network discovery, file and printer sharing, or modifying firewall rules to allow inbound connections. This behavior is associated with the Gentlemen ransomware for propagation.
Detects modification of network device AAA authentication to allow bypass
Identifies the creation or modification of unattend.xml files outside of expected deployment directories. This behavior may indicate an attempt to exploit the GreatXML zero-day vulnerability, where attackers place a crafted unattend.xml in the recovery partition to bypass BitLocker during a Windows Defender Offline Scan.
Detects process argument spoofing to hide true command line from defenders
Page 426 of 864