Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the clearing of Windows event logs using command line tools like wevtutil or PowerShell. This is a standard example rule.
Identifies instances of mshta.exe being used to execute remote payloads over HTTP/HTTPS. This matches the initial ClickFix access vector used in the Amatera Stealer campaign.
Detects the execution of a Java runtime engine masquerading as 'miicrosoft.exe', a known evasive execution technique utilized by MicroStealer to run its payload.
Detects processes utilizing ${IFS} in conjunction with Base64 decoding. This technique is used by the Gogs argument injection exploit to bypass Git branch name space restrictions while delivering encoded shell payloads.
Docker Run/Exec Guardrails Bypass
Cortex XDR
This rule detects the execution of a Docker command with the '--privileged' flag on a Linux system, combined with the execution of specific system information gathering commands. This combination is often indicative of an attempt to escape a container or gain elevated privileges within a containerized environment, potentially leading to host compromise. The '--privileged' flag grants a container nearly all capabilities of the host machine, making it a critical security concern when used maliciously.
This rule detects suspicious command-line activity involving several Windows executables (wscript.exe, cscript.exe, wmic.exe, ssh.exe) when combined with specific keywords. It looks for wscript.exe or cscript.exe executing 'SyncAppvPublishingServer.vbs', wmic.exe executing 'process', 'call', or 'create', or ssh.exe using 'ProxyCommand'. Additionally, the rule filters for command lines containing keywords like 'gal', 'i*x', 'gcm', '*stM*', 'jsdelivr.net', 'github', or 'powershell', which are often associated with malicious activity, obfuscation, or external resource loading.
The Storm-0408 malvertising campaign uses RegAsm.exe from the .NET Framework as a living-off-the-land binary for command and control. After the initial dropper from GitHub establishes a foothold, the malware injects code into RegAsm.exe to connect to C2 over TCP ports 15647 or 9000, exfiltrate data, and access DPAPI. This rule looks for RegAsm.exe launched from a temp or user writable path, which is unusual because the legitimate RegAsm is typically in the .NET Framework directory. In plain terms, it catches when a normal-looking system tool is being used from the wrong place to talk to an attacker.
Kali365 PHaaS Device Code Detection
Cortex XDR
This rule detects potential device code phishing attempts by correlating a device code flow initiated from an unmanaged/non-compliant device with a suspicious user agent (e.g., 'python-requests' or '-live') and an 'unbound' signInTokenProtectionStatus, with a subsequent 'Cmsi:Cmsi' token replay event for the same user. This combination suggests a successful device code phishing attack where an adversary has obtained and is replaying a token after the victim has authenticated.
Detects file creation, modification, or renaming events in the suspicious '%AppData%\WinDataScope' directory. This directory is hardcoded in the FrostyNeighbor dropper for staging PicassoLoader, indicating potential malware activity.
Detects wscript.exe launching mshta.exe to execute files in the temporary directory. This behavior is indicative of Gamaredon's GammaDrop launching the GammaLoad HTA payload.
Linux Timestomping via Reference FIle
Cortex XDR
Detects the use of the 'touch' command on Linux with '-m' and '-r' (reference file) or '--reference' arguments. This combination can be used for timestomping, a technique to modify file timestamps to evade detection or forensic analysis by making malicious files appear to have legitimate creation/modification times.
Detects registry modifications setting ConsentPromptBehaviorAdmin to 0, which weakens UAC protections by elevating without prompting. This behavior was observed in the TAX#TRIDENT campaign where a script disguised as a PNG altered UAC policies prior to silently installing a ManageEngine agent.
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
Detektiert Gremlin Stealer TTPs wie Crypto-Clipping oder Session-Hijacking durch Analyse von verdächtigen Prozessbefehlen und Ressourcen-Manipulation laut Unit 42 Bericht.
Monitors Cisco Catalyst SD-WAN Controller logs for successful administrative logins. This may indicate exploitation of an authentication bypass vulnerability granting unauthorized admin access.
Linux SELinux Setenforce
Cortex XDR
Detects attempts to disable SELinux by executing the 'setenforce 0' command on Linux systems. Disabling SELinux can reduce the security posture of a system and is often performed by attackers to bypass security controls.
Detects the creation of an unexpected LaunchAgent property list named 'com.google.keystone.agent.plist' paired with the creation or execution of a binary at '~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate'. This exact path and plist combination is used by the SHub Reaper malware to establish persistent backdoor access while masquerading as a Google software update.
Detects possible MFA-approved session replay by identifying abnormal reuse of authenticated sessions across multiple IPs, browsers, and devices compared against a 14-day historical baseline. The rule prioritizes browser/device anomalies over geography since modern attackers often use same-country VPS/proxies.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Correlation rule that counts the events produced by Kubernetes Audit Event Deletion base rule
Detects make explicitly loading a Makefile from temporary or non-standard locations, often used to run arbitrary commands (due to writeable capability) via a trusted build utility.
Page 476 of 864