Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects attempts at Server-Side Template Injection (SSTI) by looking for specific patterns in HTTP URI requests. It triggers an alert if the URI contains sequences like `{{.*}}` or `${.*}`, which are commonly used in various template engines to inject and execute code.
This rule detects Telnet login attempts using the default credential 'admin'. It specifically looks for the string 'admin' (case-insensitive) in Telnet traffic flowing to the server. A threshold of 5 attempts within 60 seconds from the same source IP triggers the alert, indicating a potential brute-force or credential stuffing attack against Telnet services.
This rule detects a potential RDP brute force attack by monitoring for a high number of TCP SYN packets directed to port 3389 (RDP) on the home network from a single source IP address within a short timeframe. Specifically, it triggers an alert if 10 or more SYN packets are observed from the same source within 60 seconds, indicating an attempt to establish multiple RDP connections, which is characteristic of a brute force attempt.
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
This rule detects HTTP traffic where the URI contains ".sct" (scriptlet) in a case-insensitive manner. This is indicative of an attempt to download a scriptlet, which can be used by MSHTA (Microsoft HTML Application host) for defense evasion, often to execute malicious code.
This rule detects the presence of a large Base64 encoded string (at least 100 characters) within the HTTP client body of network traffic. This pattern is often used by attackers to obfuscate malicious payloads, aligning with the MITRE ATT&CK technique T1027 for Defense Evasion.
This rule detects potential GitHub token theft or abuse activity by identifying GitHub tokens that are used from an unusually high number of distinct IP addresses or for an unusually high number of uses within a one-hour window. Specifically, it looks for tokens with more than 5 uses and more than 2 distinct IP addresses in an hour. This behavior could indicate that a compromised token is being used by an attacker from multiple locations or in an automated fashion.
Detects the creation of the '\REDSUN' named pipe, which is used by the CVE-2026-41091 exploit for inter-process communication. This pipe facilitates the transfer of session ID information between the user-level exploit and the SYSTEM-level payload.
This rule detects suspicious execution of AADConnect synchronization processes (ADSync.exe or Microsoft.Azure.AD.Sync.exe) that are not initiated by the services.exe parent process or do not contain 'scheduled' in their command line. This pattern could indicate an attacker attempting to manipulate or leverage AADConnect for privilege escalation or lateral movement between on-premises and cloud environments, as observed in Silk Typhoon activity.
Detects the creation or modification of the 'DontOfferThroughWUAU'
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
MiniPlasma PoC Registry Artifacts
Cortex XDR
Detects the creation of specific registry keys in the .DEFAULT user hive associated with the MiniPlasma (CVE-2020-17103) proof-of-concept exploit. This exploit is a privilege escalation vulnerability.
Detects the execution of VSLauncher.exe (Microsoft Visual Studio Version Selector) from the SysWOW64 directory. This behavior is highly anomalous and indicates potential DLL sideloading of input.dll (PassMark Endpoint) by threat actors such as UAC-0184 to repurpose a signed binary's network stack.
Detects the use of bitsadmin.exe to download the Argamal RAT encrypted payload file (zaesdl.dat) from remote sources like GitHub. This activity is indicative of an adversary attempting to transfer malicious tools into a compromised environment.
Identifies suspicious token authorizations for the Google Chrome OAuth client. Tycoon 2FA operators frequently use this specific client and scope to proxy authentications and capture session cookies. In a complete attack sequence, this event occurs within a 1-second window alongside a login_success and a device registration event.
Detects the creation or modification of inbox rules in Exchange, which OilRig uses to hide and manage their steganographic email C2 communications.
This rule detects the use of specific command-line flags in Google Chrome processes that are associated with the FlutterShell backdoor. These flags, '--hide-crash-restore-bubble' and '--disable-session-crashed-bubble', are used by FlutterShell to suppress crash warnings after forcing a restart, indicating an attempt to evade detection or maintain persistence.
Detects the creation of the 'TieringEngineService.exe' bait file within a specific RedSun temporary directory pattern (RS-{GUID}) associated with the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to exploit Windows Defender.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
Auto-Color is a Linux backdoor that installs a malicious library libcext.so.2 and writes it to /etc/ld.preload so the library loads before all other executables. This allows the malware to hook libc functions and hide its C2 connections. This rule looks for modifications to ld.preload or the presence of libcext.so.2 in the library path. In plain terms, it catches when a backdoor is trying to make itself invisible by loading first and controlling what the system reports.
Detects attempts to bypass User Account Control (UAC) by hijacking the execution flow of the auto-elevated fodhelper.exe binary via modifications to the ms-settings registry keys in the HKCU hive. Silent Stealer leverages this specific registry hijack to seamlessly gain elevated privileges without triggering user prompts, an essential step for its deep credential extraction processes.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Page 471 of 864