Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
Detects the Miasma worm kill chain triggered via binding.gyp during npm install. The attack
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
This rule detects suspicious Azure AD sign-in activity where a user successfully signs in from multiple unusual cities within a 24-hour period. It specifically looks for sign-ins that are not from a trusted network and are not from a compliant device, aggregating successful sign-ins by UserPrincipalName and IpAddress, and flagging if there are 5 or more distinct cities.
This rule detects potential tampering with Conditional Access Policies in Azure Active Directory by monitoring for multiple update, delete, or add operations on policies containing 'Conditional Access' in their display name within a one-hour window. This could indicate an adversary attempting to weaken security controls to maintain access or bypass MFA.
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects instances where rundll32.exe is launched by explorer.exe and includes command-line parameters indicative of network communication (http, https) or WebDAV activity (davclnt.dll, WebDAV, \\). This behavior can be associated with forced authentication attempts or execution of remote code.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
Detects suspicious execution of rundll32.exe initiated by explorer.exe that includes network-related command-line arguments (http, https, .dll, entrypoint). This pattern can indicate malicious DLL loading or execution attempting to establish network communication, potentially for command and control or data exfiltration. The rule filters out common system accounts and focuses on infrequent occurrences.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
This rule detects the creation of new service principals or the assignment of new role assignments to existing service principals in Azure Active Directory. It specifically looks for assignments that grant high-privilege roles such as "Contributor", "Owner", or "Global Admin". The rule aggregates these changes by target and time, highlighting instances where multiple changes or distinct initiators are involved.
This rule detects potential credential abuse of service principals or applications by identifying an unusual number of activities from a single service principal or application across multiple distinct IP addresses within a one-hour window. It specifically monitors sign-in logs for applications like 'Azure CLI', 'GitHub', or 'CustomApp' where the user type is 'ServicePrincipal' or 'Application'. A threshold of more than 10 activities and more than 2 distinct IP addresses within an hour triggers an alert.
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
Page 464 of 864