Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects a recurring download pattern associated with Microsoft BITS (Background Intelligent Transfer Service). Specifically, it looks for HTTP traffic where the User-Agent header contains "Microsoft BITS" and triggers an alert if 10 such events occur within 3600 seconds from the same source IP address. This pattern can indicate an adversary using BITS for persistent downloads, potentially for malware delivery or command and control.
This rule detects SMB authentication attempts that might be indicative of a 'Pass-the-Hash' attack (ATT&CK T1550.002). It specifically looks for NTLMSSP (NT LAN Manager Security Support Provider) traffic on TCP port 445 (SMB) where the NTLM authentication message contains a specific sequence of null bytes, which can be characteristic of a hash being passed instead of a cleartext password.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
Detects the execution of IntelAudioService.exe (a renamed dtlupdate.exe) using specific command-line arguments to side-load the SPECTRALVIPER backdoor. This activity is associated with OceanLotus (APT32) operations targeting Vietnam.
Detects setting IsHidden on a macOS user record to suppress the account from the login screen.
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Detects specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files (e.g., mev.png, USO.ico, USO.png) to evade detection.
This rule detects the creation, modification, or renaming of files associated with PCPJack/TeamPCP malware on Linux systems. It specifically looks for these activities in common temporary directories (`/tmp/`, `/dev/shm/`, `/var/tmp/`) and for files with names matching known PCPJack/TeamPCP artifacts (e.g., `pcpcat`, `teampcp`, `xmrig`, `proxy.sh`, `kube.py`, `.pcpx`, `.pcp`) or hidden files (starting with a dot). This activity often indicates the initial staging or persistence mechanisms of the malware.
Payload Ransomware Execution Flags
Cortex XDR
Detects the execution of a process using specific command-line flags associated with Payload ransomware's anti-forensic capabilities (e.g., --bypass-etw, -li).
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
Detects the use of regsvr32.exe to execute a remote scriptlet (.sct file) via a URL, a technique often referred to as 'Squiblydoo'. This method bypasses application control by leveraging a trusted Microsoft binary to proxy execution of malicious code.
Detects manipulation of running application data via web shell commands
Detects MMC used with MSC files for malicious proxy execution
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to privilege escalation or container escape. This includes configurations such as enabling hostNetwork, allowing privilege escalation within containers, or running containers as the root user (UID 0).
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
This rule detects HTTP traffic containing the strings "LogonUserA" and "ImpersonateLoggedOnUser" (case-insensitive) in the file data. This combination of strings suggests an attempt to create a token for impersonation, which is a technique used for privilege escalation, specifically related to the MITRE ATT&CK technique T1134.003 (Token Impersonation/Theft: Impersonation). The rule is designed to identify shellcode or malicious code attempting to leverage these Windows API functions for privilege escalation.
This rule detects HTTP POST requests to graph.microsoft.com with the URI containing 'roleAssignmentScheduleRequests'. This pattern is indicative of an Azure PIM (Privileged Identity Management) Just-in-Time role activation request, which is a mechanism for users to temporarily elevate their privileges within Azure AD. While a legitimate administrative action, it can also be used by attackers for privilege escalation.
This rule detects attempts to modify domain trust relationships via LDAP write operations. It specifically looks for TCP traffic on port 389 (LDAP) to the home network, containing the case-insensitive strings "trustType" and "trustDirection". This activity could indicate an attacker attempting to establish or alter trust relationships between domains for privilege escalation or lateral movement.
This rule detects attempts to establish a raw socket connection that is not TCP, UDP, or ICMP. This behavior can be indicative of a socket filter backdoor, where an attacker uses raw sockets to bypass standard network stack processing and potentially sniff or inject arbitrary network traffic. The rule specifically looks for outgoing connections from the home network to any destination where the IP protocol is not 6 (TCP), 17 (UDP), or 1 (ICMP).
This rule detects HTTP POST requests to Amazon Web Services (AWS) endpoints that are associated with non-standard or less common cloud regions. Specifically, it looks for 'amazonaws.com' in the HTTP host and then checks the HTTP URI for region codes 'ap-east' (Asia Pacific - Hong Kong), 'me-south' (Middle East - Bahrain), or 'af-south' (Africa - Cape Town). The detection is triggered when a resource creation (indicated by HTTP POST) is attempted in one of these regions, which might be unusual for an organization primarily operating in other regions, potentially indicating unauthorized activity or misconfiguration.
This rule detects the delivery of a potential rootkit payload via HTTP download. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'rootkit', 'rkill', 'kernel.module', or 'lkm' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
Page 446 of 864