Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects potential privilege escalation where an identity with iam:PassRole permissions deploys or updates compute resources (CloudFormation, EC2, or Lambda) to assume a more privileged IAM role than the user currently holds.
Detects anomalous Entra ID sign-in patterns indicating potential session hijacking or stolen session cookie replay. The rule identifies pairs of successful sign-ins where the geographic distance and time elapsed suggest impossible travel, or where the device/browser context changes without a fresh MFA challenge, suggesting the bypass of authentication requirements via persistent session tokens.
Detects successful authentication attempts using legacy protocols or non-interactive refresh tokens for user accounts previously flagged within a 14-day window as being involved in infostealer or credential exposure events.
This rule detects potential session hijacking by monitoring for the reuse of session or refresh tokens from unrecognized devices, browsers, or user agents, particularly when such activity occurs without an interactive MFA challenge. This behavior is indicative of an attacker attempting to use stolen session cookies or tokens to access cloud resources.
Detects the creation or modification of inbox rules in Office 365 that exhibit suspicious characteristics, such as external forwarding, automatic deletion/moving of sensitive emails (e.g., security alerts, junk), or rules containing keywords related to fraud. The rule optionally correlates this activity with recent anomalous sign-in attempts by the same user to identify potential account compromise.
Detects potential lateral movement by users who have recently been flagged for credential theft or infostealer activity. The rule correlates initial security alerts with subsequent Windows logon events (RDP, network/WinRM) or SMB share access, identifying users connecting to multiple distinct destinations within a 48-hour window.
Detects the execution of a Control Panel (.cpl) item using control.exe or rundll32.exe. The rule specifically looks for CPL files that were recently written to suspicious directories (Temp, AppData, Downloads) and correlates this execution with subsequent suspicious behaviors, such as spawning Python processes, outbound network connections, or registry modifications consistent with key storage or payload persistence.
Detects instances where a process attempts to delete its own executable file image shortly after being launched. This behavior is often associated with malware attempting to minimize its forensic footprint, such as self-deleting installers or RAT (Remote Access Trojan) components that move to a different location or execute from memory.
Detects execution of rundll32.exe with suspicious command-line patterns, including paths containing 'DavWWWRoot' (indicating potential remote file execution/WebDAV abuse), specific malicious DLL function exports, or launching from PowerShell. These techniques are commonly used to execute payloads from remote locations or to bypass traditional security controls.
This rule detects a sequential multi-stage execution chain starting with msiexec.exe launching a hidden PowerShell script, followed by wscript.exe executing a VBScript agent, and finally node.exe executing a JavaScript file within a short time window. This pattern is indicative of a complex, multi-stage dropper or malware execution flow.
Detects the presence of Node.js runtime files (node.exe, index.js) or script-based agents (vbs, ps1) located within user-profile paths (AppData) that mimic legitimate Windows system folders. This pattern is characteristic of masquerading techniques used to stage or run malicious agents under the guise of system components.
Detects the staging of ChainScript files into specific, masquerading subdirectories within user AppData folders that mimic legitimate Windows system paths. This activity is indicative of the _scatter.ps1 script redistributing components such as the Node.js runtime, agent configuration, and helper utilities before execution.
Detects anomalous authentication patterns where multiple distinct user identities authenticate from the same source IP (often a VPN or proxy) within a short timeframe, characteristic of North Korean IT worker laptop-farm or identity-mule operations where a single operator manages multiple contractor accounts.
Detects user authentication events to recruitment, career, or applicant-tracking applications where the connection originates from an anonymizing proxy, VPN, or datacenter IP address. This behavior has been observed as a precursor to North Korean IT worker recruitment fraud, where attackers mask their true geographic location to gain unauthorized employment.
Detects user account sign-in attempts originating from a country not observed in the previous 30 days, or from an ISP flagged as a VPN, proxy, or hosting/cloud provider. This behavior is consistent with an adversary utilizing stolen credentials or session tokens through anonymity infrastructure to bypass conditional access policies.
This rule detects inbound Microsoft Teams calls originating from external or federated tenants where the caller's display name attempts to mimic internal IT support, help desk, or departmental roles. This behavior is a hallmark of vishing (voice phishing) attacks, often used as a secondary phase in social engineering campaigns following initial contact via email.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects inbound emails containing malicious QR codes (quishing) or HTML smuggling payloads designed to facilitate credential harvesting (AiTM). The rule identifies suspicious attachments, HTML-based obfuscation (e.g., atob, Blob) in email bodies, and QR-code-themed image attachments, filtering out internal communications.
Detects the use of 7-Zip (7z.exe) to extract a file named drata.dat using command line arguments that indicate silent extraction from an encrypted or password-protected archive. This behavior is associated with the LegionLoader malware, which uses this technique to stage its payload.
Detects the installation of a Windows service where the ImagePath points to a gitlab-runner executable but the ServiceName deviates from the default 'gitlab-runner' name. This technique is often used to mask persistence or evade simple naming-based detections by utilizing the --service flag to rename the runner service.
Detects a cluster of Windows Event IDs 4740 (Account Lockout) or 4724 (Password Reset) targeting the local 'Administrator' account across multiple hosts within a short time window. This activity is indicative of automated or mass account manipulation often associated with ransomware payloads or centralized GPO-based credential tampering.
Page 51 of 864