Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects creation of dot-prefixed hidden files used to hide malware on Linux/macOS
Detects delivery of process injection toolkit payloads via network
Detects modification of PAM configuration files allowing authentication bypass
Detects delivery of malicious dylib files for macOS library hijacking
Detects node.exe deleting a 24-character hexadecimal JavaScript file from the Temp directory after execution, which is indicative of the Mastra NPM supply chain attack.
Identifies inbound emails claiming to be from an internal domain where the sender IP does not match the expected authorized third-party MX record or spam filter IP addresses. This rule focuses on emails successfully delivered to the user, where the sender domain claims to be one of the organization's internal domains, and the sending IP is not among the expected external MX or spam filter IP addresses.
This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.
Detects changes to file permissions (chmod +x) for files located within the /tmp directory. This activity is often observed with malware droppers, such as Miasma, which use this technique to make downloaded payloads executable before launching them.
Detects the creation of hidden files (starting with a dot) in the `/tmp` directory on Linux systems. This behavior can be indicative of malware like Miasma hiding intermediate exfiltration data or configuration files.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Detects the execution of the Windows built-in 'tar' utility to extract files into the specific public 'AccountPictures' directory. This behavior is indicative of the setup phase of APT37's NarwhalRAT.
This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.
Detects the creation of 'msedge.zip' in the 'C:\ProgramData\' directory, which is an indicator of Node.js staging, often associated with malicious activity.
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
Detects executions of specific renamed binaries (Genuine.exe, Updater.exe, AutoCAD242.exe) or the original Toolbox.exe utilizing the '-uiDll' flag. This is indicative of DLL side-loading behavior abused by OceanLotus to deploy the SPECTRALVIPER backdoor.
This rule detects an unusual number of local or remote interactive logons (LogonType 2 or 10) by the 'SYSTEM' account within a one-hour window. While the SYSTEM account is legitimate, direct interactive logons are rare and multiple occurrences could indicate an attempt to escalate privileges or maintain persistence by an attacker.
This rule detects multiple executions of 'netsh firewall' commands within a one-hour window on a single computer. This activity can indicate an adversary attempting to modify or disable system firewalls to bypass security controls, enable C2 communications, or facilitate lateral movement.
This rule detects potential process hollowing or process blanketing attempts by monitoring Windows Security Event ID 4688 (A new process has been created) and checking if the command line contains the strings 'ProcessHollowing' or 'ProcessBlanketing'. These strings in the command line of a newly created process could indicate an attempt to inject malicious code into a legitimate process to evade detection.
This rule detects the creation of new processes (EventID 4688) where the command line contains keywords commonly associated with User Account Control (UAC) bypass techniques, such as 'uac', 'UAC', or 'bypassuac'. This could indicate an attempt to elevate privileges without user consent.
Detects attempts to modify Cisco ROMMON firmware for deep persistence
Page 433 of 864