Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects potential GitHub token theft or abuse activity by identifying GitHub tokens that are used from an unusually high number of distinct IP addresses or for an unusually high number of uses within a one-hour window. Specifically, it looks for tokens with more than 5 uses and more than 2 distinct IP addresses in an hour. This behavior could indicate that a compromised token is being used by an attacker from multiple locations or in an automated fashion.
Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.
Detects multiple registry value set events where the registry value data contains keywords like 'ransom' or 'payment', or the registry key contains 'Run'. This behavior can indicate ransomware activity attempting to establish persistence or communicate its demands.
This rule finds an npm package whose main index.js file was swapped for a much larger obfuscated version. Maintainers may not notice a silent replace during a compromise. Compare package hashes to known good releases. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects suspicious access attempts to file system objects (hard disk volumes or DOS devices) by non-system accounts. It specifically looks for Event ID 4656 (Handle to an Object was Requested) where the ObjectName contains "\Device\HarddiskVolume" or "\DosDevices\", the AccessMask indicates broad access (0x1fffff or 0x120089), and the SubjectUserName is not a standard system account (SYSTEM, LOCAL SERVICE, NETWORK SERVICE). The rule then aggregates these events over one-hour intervals and flags if five or more such access attempts occur from the same computer and user.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring the creation of processes for 'fodhelper.exe', 'computerdefaults.exe', or 'slui.exe' when their parent process is not 'explorer.exe' or 'svchost.exe'. These executables are known to be used in UAC bypass techniques to elevate privileges without user interaction.
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
This rule detects suspicious activity involving the creation or update of managed identities and the assignment of highly privileged roles (Contributor, Owner, User Access Administrator) to them. It specifically looks for multiple such assignments within a one-hour window to managed identities associated with automation, runbook, or function resources, indicating potential privilege escalation or malicious access.
This rule detects an account performing multiple interactive logons (LogonType 2) from at least 3 unique IP addresses within a 5-minute window. This behavior can indicate credential compromise or an adversary attempting to move laterally or access multiple systems using stolen credentials.
This rule detects when two or more files with suspicious names (e.g., 'update.exe', 'temp.exe', 'setup.exe') are created within a short timeframe (1 hour) in common user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. This pattern can indicate the dropping of malicious payloads or staging of files by an adversary.
This rule detects modifications to registry keys (EventID 4657) where the new value contains strings commonly associated with Command and Control (C2) configurations, such as 'C2', 'beacon', 'callback', 'command_server', 'c2_ip', or 'control_server'. This could indicate an adversary establishing or modifying C2 communication channels via the registry.
This rule detects multiple WinRM authentication attempts using basic authentication from a single source IP address to the local network. It specifically looks for the 'Authorization: Basic' header in TCP traffic destined for port 5985 (default WinRM port) and triggers an alert if five such attempts occur within 30 seconds from the same source.
This rule detects attempts to log in to a Telnet server using the default credential 'admin'. It specifically looks for the string 'admin' in TCP traffic directed to the HOME_NET on port 23 (Telnet). A threshold of 3 attempts within 30 seconds from the same source IP triggers the alert, indicating a potential brute-force or default credential attack.
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Detects excessive caret (^) escaping in command lines, a common obfuscation technique used by attackers to evade detection and conceal malicious commands. The rule specifically looks for command-line executions by cmd.exe, powershell.exe, or pwsh.exe that contain more than 5 caret characters and a pattern of at least three alphanumeric characters immediately followed by a caret.
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
Detects the creation or execution of specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files to evade detection. The rule specifically looks for file names 'mev.png', 'uso.ico', or 'uso.png' in file or process events.
This rule detects when Windows Security or System event logs are cleared. Adversaries often clear event logs to remove evidence of their activities after gaining access to a system.
Detects negotiation of weak cipher suites to reduce encryption strength
Page 441 of 864