Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.
This rule detects the delivery of shellcode designed to hijack the KernelCallbackTable. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "KernelCallbackTable" and "NtUserSetWindowsHookEx" (case-insensitive) within the file data. This technique is often used for privilege escalation or persistence by redirecting kernel callbacks to malicious code.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "icacls" and "grant" (case-insensitive). This combination suggests an attempt to modify file or directory permissions, specifically granting permissions, which could be indicative of an attacker exploiting a service binary file permission weakness to establish persistence or elevate privileges. The rule is triggered when these strings are observed in traffic flowing to the server.
This rule detects a suspicious sequence of events in Okta that could indicate a help-desk social engineering attack or account takeover. Specifically, it looks for a user's password being reset, followed by the enrollment of a new MFA factor or device for that same user, all occurring within a short time frame (1 hour) and potentially from distinct session IDs or device hashes. This pattern suggests an attacker has gained initial access (e.g., via social engineering the help desk) and is immediately attempting to establish persistence by enrolling their own MFA device.
Detects instances of QEMU emulators, particularly renamed binaries (e.g., svvhost.exe), executing with arguments indicative of loading a .qcow2 virtual disk image. BlackSuit affiliates are known to deploy QEMU virtual machines containing Linux or Windows operating systems to conceal backdoor proxy tools from host-level EDR.
This rule detects LDAP bind requests originating from an external source to a domain controller (port 389) within the home network. It specifically looks for the 'bindRequest' content in TCP traffic and triggers an alert if 10 such requests are observed from the same source within a 30-second window. This could indicate an attempt to enumerate or authenticate against directory services from outside the internal network, potentially as part of initial access or reconnaissance.
Detects the command-line usage of WinGet invoking a configuration file, specifically targeting switches designed for silent, non-interactive execution. This behavior can be indicative of an adversary attempting to install or configure software without user interaction, potentially for persistence, defense evasion, or to establish command and control.
This rule detects indicators of compromise (IOCs) associated with the Red Lamassu (JFMBackdoor) campaign. It identifies malicious file hashes, network communication with known command and control (C2) domains and IP addresses, specific file paths and names used by the malware, and registry modifications for persistence. The rule looks for file events, process creations, network connections, and registry changes that match the defined IOCs.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the execution of conhost.exe with the --headless parameter. This technique is actively used in ClickFix campaigns to silently execute clipboard-injected commands in the background without user awareness.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of the DPAPI cmdlet ConvertTo-SecureString alongside the HKCU:\Printers path. This technique binds the encryption to the active user session to hinder forensic analysis.
Detects inbound emails with voicemail-themed subjects that pass SPF and DKIM but fail DMARC alignment. This technique is often used to exploit domains with p=none policies and obscure the actual origin of phishing attempts.
Detects post-install execution of the TeamPCP-compromised Microsoft durabletask package
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
Detects failed attempts to change the system audit policy. This could indicate an adversary attempting to disable or modify security monitoring to evade detection.
This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.
This rule detects when the Windows Security Event Log (Event ID 1102) has been cleared on a system. Clearing event logs is a common technique used by adversaries to remove traces of their activity and evade detection.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
Page 463 of 864