Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
Detects suspicious patterns of driver loading activity, specifically looking for multiple driver load attempts (sc create, sc start, net start, wmic service) involving .sys, kernel, or driver files from non-System32 directories or within the Temp directory. This pattern can indicate an attempt to install a rootkit or other malicious kernel-mode software.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects execution of DWAgent from download or temporary directories rather than standard installation locations, potentially indicating unauthorized remote management activity.
Detects the loading of the Microsoft.Management.Configuration.dll image within ConfigurationRemotingServer.exe. This indicates active WinGet DSC execution, which can be abused by tools like DSCourier to proxy arbitrary code execution.
Detects the execution of the Restart-Computer cmdlet with the -Force flag via PowerShell, a technique used by a recent malware dropper to disrupt sandbox analysis.
Hades Decoy Anthropic Traffic
Cortex XDR
Detects suspicious network connections to the Anthropic API endpoint (api.anthropic.com/v1/api) used as exfiltration camouflage by the Hades campaign. The rule specifically looks for traffic to 'api.anthropic.com' with the path '/v1/api', which is documented as returning 404s, indicating potential misuse for covert communication or data exfiltration.
Hades Sentinel File Creation
Cortex XDR
Detects the creation of the '.bun_ran' sentinel file in the system temp directory, used by the Hades malicious PyPI loader to avoid repeated executions. This file acts as a marker to prevent subsequent infections or executions of the malware.
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
This rule detects when the Windows Security Event Log (Event ID 1102) has been cleared on a system. Clearing event logs is a common technique used by adversaries to remove traces of their activity and evade detection.
This rule detects an unusually high volume (10 or more within an hour) of permission changes to files or registry keys by a single user. This activity can be indicative of an adversary attempting to modify access controls to facilitate persistence, privilege escalation, or defense evasion.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
Detects execution of CRYPTBASE.dll from non‑system directories, a technique used in the STX RAT campaign to hijack legitimate installers (e.g., CPUID HWMonitor, X‑VPN).
This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
Detects PowerShell script block contents indicating the manual bypassing of SSL certificate validation. This defense evasion technique is notably used by the Gamaredon GammaLoad third stage (which executes via an encoded command) to ensure successful connection to potentially untrusted or self-signed C2 infrastructure.
This rule detects attempts to modify file timestamps over SMB. Specifically, it looks for the 'SetFileTime' operation within SMB traffic on port 445. This activity can be indicative of an adversary attempting to hide their presence or activities by making malicious files appear to have legitimate creation or modification times, a technique known as timestomping.
Page 455 of 864