Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects RomulusLoader persistence behavior where Vulkan components (vulkan-1.dll, vulkaninfo.exe) or encrypted payload files (.bin) are written to the Common Files directory by the TA4922 threat actor.
This rule detects the creation of specific files associated with AppDomain hijacking by the Nimbus Manticore threat actor. It looks for the creation of files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' directory. The rule is tuned to trigger when at least two distinct campaign files are created within a 10-minute window on the same device.
Detects instances where node or Electron processes are executed with the ELECTRON_RUN_AS_NODE environment variable set to 1. This technique is used by UNK_DeadDrop to turn an editor into a plain Node.js interpreter for stealthy payload execution.
Detects the execution of the legitimate Windows binary 'usoclient64.exe' from unusual directories. This behavior has been observed in campaigns by the threat actor 10FXRAT for DLL side-loading and persistence.
Detects the execution of taskkill.exe targeting the iediagcmd.exe diagnostic tool. This defense evasion action is performed by the PlugX payload prior to establishing a C2 communication channel to prevent network diagnostic monitoring.
Detects successful interactive device-code flow sign-ins through the Microsoft Authentication Broker application (Client ID 29d9ed98-a469-4536-ade2-f981bc1d605e). Tycoon 2FA operators frequently abuse this specific flow to bypass multi-factor authentication and steal session tokens.
Detects the creation of specific .NET configuration files (.config) used by Screening Serpens for AppDomainManager hijacking, alongside known malicious DLLs. This rule correlates the creation of the campaign's specific config file names with the deployment of its associated payloads in the same folder within a short time frame.
This rule detects suspicious activity involving Azure AD device registration followed by a sign-in from the same user and IP address, particularly when the user agent strings are indicative of non-standard clients (e.g., 'node', 'axios', 'undici', 'node-fetch'). This pattern can indicate an adversary attempting to establish persistence or bypass multi-factor authentication by registering a new device and then immediately using it for access.
ASP.NET ViewState Verification Failure
Cortex XDR
This rule detects ASP.NET ViewState verification failures, specifically looking for Event ID 1316 and event message containing 'Event code: 4009'. This can indicate an attempt to tamper with the ViewState, potentially leading to deserialization vulnerabilities or other web application attacks.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This query attempts to identify file events for javaapp.lock files which is used by Nimbus RAT as a way to to enforce single-instance execution.
Detects process execution containing the __DAEMONIZED=1 environment variable, which is used by the Shai-Hulud npm worm to detach from the parent process and run in the background.
Detects the creation of the specific sentinel file '.bun_ran' generated by the Hades Python loader to avoid repeated executions.
Detects the creation of the specific sentinel file '.bun_ran' generated by the Hades Python loader to avoid repeated executions.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
This rule detects potential EWM (Event-Window-Message) injection attempts via the SetWindowLong API by looking for the presence of both "SetWindowLongPtr" and "GetWindowLongPtr" strings in HTTP client-bound file data. This technique is often used for privilege escalation or code injection.
Detects the execution of the 'tee' command via sudo, potentially indicating local privilege escalation. This activity has been observed in VerdantBamboo campaigns exploiting a sudo misconfiguration for the 'egnyteservice' account on Egnyte Storage Sync systems.
Detects the execution of rundll32.exe with command-line arguments containing 'samcli.dll' or 'vaultcli.dll'. This pattern can indicate an attempt to execute malicious code or bypass security controls using a legitimate Windows utility.
Detects the use of bitsadmin.exe to download the Argamal RAT encrypted payload file (zaesdl.dat), a technique utilized in the Stage 2 delivery script.
This rule detects attempts to grant consent to OAuth applications, which could indicate an illicit consent grant attack. It specifically looks for successful operations related to consenting to applications, adding app role assignments to service principals, adding delegated permission grants, or adding OAuth2PermissionGrants within audit logs. The rule extracts details such as the target application, the user who consented, their initiating IP address, and the permissions granted.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
Page 468 of 864