Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects relocation of malware to new paths to evade detection signatures
Detects stolen web session cookies being replayed from different IP addresses
Detects suspicious patterns of driver loading activity, specifically looking for multiple driver load attempts (sc create, sc start, net start, wmic service) involving .sys, kernel, or driver files from non-System32 directories or within the Temp directory. This pattern can indicate an attempt to install a rootkit or other malicious kernel-mode software.
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
Detects the presence of the "__VAPTCMD__" string in process command lines. This string is identified as a placeholder marker used by the VAPT autonomous framework in confirmed remote code execution templates. This rule aims to identify potential remote code execution attempts or testing activities related to this specific framework.
Detects files with suspicious double extensions (e.g., .exe.txt, .dll.txt) or .scr extension, which can indicate an attempt to masquerade malicious executables or scripts as benign text files or screensavers. The rule excludes files in the System32 directory to reduce false positives.
Detects suspicious command-line executions indicative of potential malicious activity, including the use of certutil for encoding/decoding, bitsadmin for transfers, and various PowerShell command invocations. This rule monitors process creation events (EventID 4688) for specific command-line patterns that are often abused by adversaries for tasks such as file transfer, execution, or obfuscation.
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts' for target identification. The rule looks for multiple SSH connections within a 10-minute window from a single host and user, specifically targeting common PeopleSoft-related usernames.
This rule detects modifications to specific registry keys that are commonly used for persistence by malware. The rule looks for Event ID 4657 (A registry value was modified) and checks if the ObjectName corresponds to known malicious registry paths related to Run keys, RunOnce, or service configurations. This indicates an attempt to establish persistence or alter system behavior for malicious purposes.
Detects command-line activity referencing the specific internal Transformers configuration keys used to exploit CVE-2026-4372. This may indicate active exploitation or defensive scanning.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects TLS protocol downgrade attacks used to weaken encryption
Detects PE injection technique using NtUnmapViewOfSection
Detects Regsvr32 Squiblydoo technique for remote COM scriptlet execution
Detects attempts to bypass macOS Gatekeeper security controls
Detects replacement of service binaries for execution flow hijacking
This rule identifies processes establishing synchronization objects (mutexes) that start with the hardcoded prefix 'Global\EVOLUTION'. This pattern is indicative of the EVOLUTION stealer malware execution, as it uses this specific mutex naming convention to ensure only one instance of itself is running.
Detects use of forged web credentials for unauthorized application access
Detects install-time commands from the Triple Cross eBPF rootkit deployer that attach a BPF
filter to a host NIC via traffic control (tc). The rootkit hijacks execve and other syscalls
from kernel space to hide processes, files, and traffic while maintaining C2 access.
filter to a host NIC via traffic control (tc). The rootkit hijacks execve and other syscalls
from kernel space to hide processes, files, and traffic while maintaining C2 access.
This rule detects the delivery of a payload associated with the 'Incognito Token Theft Tool'. It specifically looks for the case-insensitive string 'list_tokens' within HTTP response body content flowing from a server to a client. This string is indicative of the tool's functionality, which often involves listing tokens for exfiltration or further abuse, suggesting an attempt at privilege escalation or credential access.
Page 430 of 864