Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the creation of specific payload staging files (filter.bin, kernel-diag.lib) in the anomalous ApplicationData32 directory, a behavior indicative of UAC-0184 staging prior to decoding and execution.
Detects registry interactions querying or accessing the Windows Defender Application Guard (WDAG) RunOnce registry key. This behavior is associated with Atlas RAT performing anti-sandbox and anti-analysis checks prior to payload execution.
Detects the creation or modification of YTSysConfig.ini or YTSysConfig.ytf, which are runtime configuration files for the ClientSetup/Yangtu payload used in the TAX#TRIDENT campaign. This activity indicates potential deployment or configuration of the malware.
Detects sign-in or Microsoft Graph API activity using user-agent strings characteristic of ROADtools and similar Python-based identity-attack tooling. The rule generalizes beyond ROADtools to catch AzureHound, MicroBurst, MFASweep, GraphRunner, and similar identity attack frameworks by looking for scripting user-agents (python, requests, urllib, curl) which signal non-browser, non-app authentication that is inherently suspicious for Entra ID admin operations.
Detects PowerShell scripts attempting to download and execute the official Deno installation script. This behavior is abused by threat actors, such as the operators behind the DinDoor backdoor, to silently prepare an endpoint for fileless JavaScript malware execution.
This rule detects the loading of modules (DLLs or executables) from user-specific AppData folders that are not commonly observed across the environment. It specifically excludes common legitimate paths within AppData like 'Local\Programs' and 'Local\Temp' to reduce false positives. The rule identifies modules loaded by processes that also originate from an AppData folder, indicating potentially suspicious activity such as malware or custom tools operating from user-writable locations.
This rule detects Attack Surface Reduction (ASR) block events where a file operation was prevented. It specifically filters out audit-only events and excludes operations on .dll and .tmp files to reduce noise. The rule aims to identify malicious activity that ASR has actively blocked, indicating a potential attempt to execute or modify files in a suspicious manner.
Detects deletion of Kubernetes events in audit logs when the request completes successfully.
Adversaries may delete events to impair defenses and cover tracks (defense evasion).
Adversaries may delete events to impair defenses and cover tracks (defense evasion).
KQL Query
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) with flags indicating an embedded browser instance and a custom user data directory pointing to the AppData\Roaming folder. This behavior is commonly leveraged by malware masquerading as simple utilities, such as the Calendaromatic malware (CL-CRI-1089), to interact with the host operating system and hide malicious activities within webview processes.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
Detects installation of Tiflux RMM components delivered through phishing campaigns. Threat actors abuse Tiflux to establish persistent remote access and subsequently deploy additional remote management tools.
Detects suspicious modifications to Notepad++ configuration files (config.xml or shortcuts.xml) by processes other than Notepad++ itself. This behavior may indicate an attempt to exploit vulnerabilities (e.g., CVE-2026-48778 or CVE-2026-48800) by injecting unvalidated interpreter commands, leading to arbitrary code execution or other malicious activities.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
This rule detects a highly suspicious sequence of events in Microsoft Entra ID (formerly Azure AD) audit logs: a self-service password reset, followed by the registration of new security information, and then the deletion of existing security information, all performed by the same user within a short time window. This pattern is indicative of an attacker taking over an account, resetting the password, establishing their own MFA/security info, and then removing the legitimate user's security info to lock them out. This behavior has been observed in campaigns like Storm-2949.
Detects the execution of specific file names and directory combinations used by the GRAT malware (Cyber Isnaad Front) to masquerade as legitimate tools before deploying ransomware or wiper modules. Specifically looks for 'Checker.exe.exe', 'WindowsUpdater.exe' in 'C:\ProgramData\', and 'SpellChecker.exe' in '\AppData\Roaming\Microsoft\Spelling\'.
This rule detects the execution of 'vsce-sign.exe' with command-line arguments indicating the verification of cached VS Code extensions. This activity is part of the normal VS Code extension installation and update process, where extensions are verified for integrity and authenticity. While this is a legitimate process, monitoring it can be useful for identifying anomalies or potential supply chain compromises if unexpected extensions are being verified or if the verification process itself is being abused.
Identifies potentially malicious client-side redirects or forced OAuth flows initiating from the Outlook Web Access (OWA) interface, characterized by 302 statuses and redirect parameters. This activity may indicate post-exploitation actions related to CVE-2026-42897.
Identifies package managers (like npm or yarn) executing suspiciously placed setup binaries from hidden or unconventional folders (e.g., tools/setup, .github/scripts/precheck) indicative of IronWorm preinstall hooks.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Page 474 of 864