Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the creation or modification of TieringEngineService.exe in the System32 directory, which is indicative of potential Local Privilege Escalation (LPE) via junction redirection, as observed in the RedSun exploit (CVE-2026-41091). The rule specifically excludes activities originating from the Windows WinSxS directory to reduce false positives from legitimate system updates.
This rule detects network traffic on port 445 (SMB) containing the string "SetFileSecurity" (case-insensitive). This string is associated with modifying file security descriptors, specifically Discretionary Access Control Lists (DACLs), which can be used by attackers to hide malicious files or achieve persistence by altering permissions.
This rule detects attempts to use 'mavinject.exe' for DLL injection into a running process over HTTP. It specifically looks for HTTP requests containing 'mavinject' and '/INJECTRUNNING' in the URI, indicating a potential malicious use of the Mavinject utility for defense evasion.
Detects the creation of files ending with '.sig', '.asc', or '.cer'. These extensions are commonly associated with digital signatures, PGP/GPG keys, and certificates, which could indicate activities like code signing, certificate generation/import, or PGP/GPG key manipulation by an adversary.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
Detects suspicious network connections to a non-existent Anthropic API endpoint (api.anthropic.com/v1/api). This specific route is used as network camouflage and decoy traffic by the Hades PyPI supply chain malware campaign.
This rule detects an unusually high volume of registry access events (Event ID 4656) targeting either the 'HKLM' (HKEY_LOCAL_MACHINE) hive or 'System Registry' within a one-hour window. A count of 10 or more such events by a single user on a specific computer within an hour is considered suspicious. This activity could indicate an adversary attempting to enumerate system configurations, modify system settings for persistence, or gather information.
Detects hiding a user home folder with chflags, complementing account-level hiding
documented in T1564.002.
documented in T1564.002.
This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.
Detects the execution of PowerShell scripts containing strings associated with the DAYLIGHT obfuscator. This obfuscator is utilized by the Russia-nexus threat group GREYVIBE to hide post-compromise payloads and PhantomRelay implants.
Detects successful Microsoft Entra ID sign-ins where the user agent indicates a Node.js-based HTTP client (e.g., node, axios, undici, node-fetch). Tycoon 2FA and other AiTM phishing kits heavily leverage these backend automated tools for token relay and renewal immediately following MFA interception.
Detects the creation of CRYPTBASE.dll outside of the standard Windows system directories. This indicates an attacker staging the DLL for sideloading to exploit CWE-427 upon application execution.
Detects the execution of the zenity dialog tool spawned by unusual parents (like IDEs or bash scripts) to create fake password prompts on Linux. The Linux variant of UNK_DeadDrop utilizes this to trick developers into providing their system passwords, enabling root access and GNOME Keyring extraction.
Detects the Intune Management Extension agent launching command shells or system utilities. Because Intune executes scripts as SYSTEM, detecting this behavior on the endpoint is critical for identifying malicious script deployments.
Detects rundll32.exe loading content directly from a UNC path. This behavior is rare in enterprise environments and was observed in ACR Stealer delivery chains.
Identifies mshta.exe accessing externally hosted HTA content from a user-initiated Explorer session, potentially indicating malicious remote code execution.
Detects named pipe activity with remote access enabled, initiated by JsonVMAccessExtension.exe running as SYSTEM. This may indicate abuse of the Azure VM Access Extension for unauthorized remote access.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Detects modifications to the 'BlockedApps' registry key within the CloudFiles policy path, specifically looking for symbolic link setups pointing to the Volatile Environment as used in the MiniPlasma LPE exploit.
This Suricata rule detects potential steganography payloads embedded within image downloads. It specifically looks for the JPEG file signature `FF D8 FF` within the first 3 bytes of an HTTP response, combined with a large file size (greater than 500KB). The rule also includes a threshold to prevent excessive alerts, triggering if 5 such downloads occur from the same destination within 60 seconds. This behavior is indicative of an attempt to hide malicious code or data within seemingly innocuous image files to evade detection.
This rule detects potential domain fronting by identifying a mismatch between the Server Name Indication (SNI) field in the TLS handshake and the Host header, specifically when the SNI field contains domains commonly used for content delivery networks (CDNs) like cloudfront.net, azureedge.net, or fastly.net. This technique can be used to obfuscate the true destination of network traffic, often for malicious purposes such as bypassing censorship or exfiltrating data.
Page 461 of 864