Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects HTTP requests originating from Microsoft Office Word that are attempting to fetch remote templates with specific file extensions (.dotx, .dotm, .dot). This behavior can be indicative of malicious documents attempting to retrieve external content, often used in phishing or malware delivery campaigns to bypass security controls or fetch additional stages of an attack.
This rule detects the delivery of an Electron application ASAR (Atom Shell Archive) package over HTTP. The detection is based on the presence of '.asar' in the HTTP URI, indicating a potential malicious Electron application being downloaded to a client within the home network. Electron applications are often used for desktop applications and can be exploited if malicious code is embedded within their ASAR packages.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
Detects PowerShell commands that include references to memory manipulation APIs such as Reflection.Assembly, VirtualAlloc, WriteProcessMemory, and CreateThread. These APIs are often associated with advanced techniques like reflective PE injection or shellcode execution, indicating potential malicious activity.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
Detects creation of Intune device management scripts, a potential privilege abuse vector.
Detects NOP sled patterns in payloads indicating junk code insertion for evasion
Detects non-standard encoding schemes used to obfuscate C2 traffic
Detects Mavinject used for DLL injection into running processes
Detects download of UAC bypass and elevation control bypass tools
Detects process argument spoofing techniques to hide true command line from forensics
Detects deployment of privileged Docker containers that may allow container escape
Detects polymorphic malware payloads that mutate to evade static signatures
Detects TFTP boot image transfers to network devices for persistent firmware modification
Detects inbound email that fails SPF authentication indicating email spoofing
Detects Regsvcs or Regasm used for COM assembly proxy execution
Detects certutil abuse for payload download or base64 decode
Detects InstallUtil used for .NET assembly proxy execution
Detects clearing of Linux system log files to remove forensic evidence
Detects files using space after extension to disguise executable files
Detects disabling of code signing enforcement via registry
Page 438 of 864