Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects HTTP traffic where the URI contains both 'certutil' and '-decode' (case-insensitive). This pattern is indicative of an attacker using the Windows built-in 'certutil.exe' utility to decode a file downloaded via HTTP, often as part of a defense evasion or payload extraction technique. The 'flow:to_server,established' indicates that the detection is looking for this pattern in requests going from the internal network to an external server, suggesting a client-initiated download or interaction.
This rule detects HTTP POST requests to cloud compute infrastructure management endpoints, specifically Amazon EC2, Google Cloud Compute, and Azure Management. The rule is triggered if 20 such requests are observed from a single source IP within 60 seconds, indicating potential automated activity to modify cloud infrastructure for evasion purposes.
This rule detects attempts to move executable files (.exe) over SMB (Server Message Block) by looking for the 'MoveFile' string and the '.exe' extension in network traffic on port 445. This activity could indicate malware being relocated on a network share.
This rule detects the delivery of a malicious Control Panel (.cpl) file over HTTP. It specifically looks for HTTP responses containing a URI ending with ".cpl" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This technique is often used for defense evasion and to execute malicious code.
This rule detects HTTP requests where the URI contains specific system script names like 'pubprn', 'syncappvpublishingserver', or 'winrm'. These scripts are known to be abused by attackers to proxy code execution, often as a defense evasion technique. The rule specifically looks for these patterns in HTTP URIs in traffic flowing to the server.
This rule detects attempts to execute commands indirectly via 'bash.exe' on Windows systems, specifically looking for HTTP requests where the URI contains both 'bash.exe' and the '-c' argument, which is commonly used to pass commands to a shell. This behavior is indicative of an attacker using Bash on Windows (e.g., Windows Subsystem for Linux or Git Bash) to execute arbitrary commands, potentially as part of a defense evasion or command and control tactic.
This rule detects attempts to leverage Regsvr32 for COM scriptlet remote execution. It specifically looks for HTTP traffic where the URI contains '.sct' (indicating a scriptlet file) and the file data contains XML content with the word 'registration', which are common characteristics of COM scriptlets used in Regsvr32 attacks.
This rule detects the delivery of a payload that uses InstallUtil for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "System.Configuration.Install" and "Installer" (case-insensitive) within the file data. This pattern is indicative of malicious use of InstallUtil, a legitimate Microsoft utility, to execute code, often for defense evasion.
This rule detects attempts to inject remote office templates via HTTP. It specifically looks for HTTP traffic flowing to the client that contains both 'attachedTemplate' and 'http' (case-insensitive) in the file data, indicating a potential attempt to load a remote template.
This rule detects HTTP responses containing XSL Transform with embedded JScript payloads. It specifically looks for the presence of 'language="JScript"' and 'WScript.Shell' within the file data of an HTTP response flowing to the client. This combination indicates an attempt to execute JScript code, potentially for malicious purposes, often associated with defense evasion or initial access techniques.
This rule detects emails sent over SMTP where the 'From:' and 'Reply-To:' headers are present, indicating a potential attempt to spoof the sender's display name while using a different domain. It triggers an alert if 10 such emails are observed from the same source within 60 seconds, suggesting a bulk email or phishing attempt.
This rule detects activity associated with the GhostLock ransomware by combining three types of signals: file artifact creation/access, specific Python module loads indicative of GhostLock's execution, and the presence of GhostLock-specific command-line arguments. It aims to identify the ransomware across different stages of its operation.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Explorer File Visibility Downgrade
Cortex XDR
Detects modifications to Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) to conceal files. This technique is often used by malware, such as GammaWorm, as a defense evasion mechanism to hide malicious artifacts from users and security tools. The rule specifically looks for changes to the 'Advanced' registry key path within 'Software\Microsoft\Windows\CurrentVersion\Explorer' that would result in files or file extensions being hidden.
Detects wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags. This pattern is used by JS.MonoGlyphRAT to decrypt and execute AES-encrypted payloads while evading static analysis.
Detects malware using mutexes to prevent multiple instances running simultaneously
Detects replacement of SIP trust provider DLL for code signing bypass
Detects the anomalous download or extraction of the Bun JavaScript runtime. The Miasma worm downloads Bun during npm/node-gyp installation phases to execute its payloads outside of standard Node.js monitoring, evading detection.
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.
Detects the execution of mshta.exe where the command line arguments reference a file with a .pdf extension. This technique is used by Gamaredon (GammaPhish) to execute disguised HTA payloads after WinRAR exploitation.
Detects the execution of the initial stage DLL payload (endpointdlp.dll) via rundll32.exe calling a specific ordinal (#2) to decrypt and load the final MLTBackdoor payload. This behavior is highly specific to the MLTBackdoor threat.
Page 454 of 864