Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects instances where the Greenshot.exe application loads DLLs (log4net.dll, GreenshotPlugin.dll, LinqBridge.dll) from locations outside of the expected installation directory ('\Program Files\Greenshot' or '\Program Files (x86)\Greenshot'). The rule also tracks the creation of configuration or updater files ('greenshot-defaults.ini', 'updater.bat') which may be indicative of unauthorized modification, persistence, or potential DLL side-loading attempts.
Detects execution of Windows Installer packages (MSI) masquerading as common software installers (Spotify, Zoom, Microsoft Teams) using known ChainScript-style naming patterns and suspicious command-line parameters (e.g., ALLUSERS=2, MSIINSTALLPERUSER=1) or invocation from common user-mode applications like cmd.exe, powershell.exe, or explorer.exe.
Detects potential anti-analysis or sandbox evasion behavior where a process checks for the existence of the Cursor IDE application using native system utilities like ps, pgrep, or lsof. This check is often used by malware (such as the FLATROOF/ROOFDECK backdoors) to gate beaconing activity by ensuring the execution environment is not an analysis sandbox.
Detects the use of PowerShell to delete files with common script or shortcut extensions from directories frequently used for persistence or staging malicious payloads, such as APPDATA, ProgramData, and the Startup folder.
Detects Azure AD user sign-ins from multiple distinct IP addresses or countries within a 1-hour window. This is a common heuristic used to identify potentially compromised credentials or impossible travel scenarios, where a single user account authenticates from geographically distant or disparate network locations in an unrealistic timeframe.
Detects unauthorized code injection attempts into web browser processes (chrome.exe, msedge.exe) by non-browser related processes. This behavior involves using APIs like CreateRemoteThread, NtAllocateVirtualMemory, or NtWriteVirtualMemory to modify memory and execute remote threads, which is a common technique used by information stealers such as LummaC2 to bypass browser security controls.
Detects a sequence of API calls (NtAllocateVirtualMemory, WriteProcessMemory, and CreateRemoteThread) targeting browser processes (chrome.exe, msedge.exe) from a non-browser process, consistent with shellcode injection patterns used by the Remus infostealer to bypass browser security features.
Detects instances where a user account modifies security information, registers a new MFA method, or resets a password shortly after a successful sign-in from a country not observed for that user within the previous 30 days. This pattern is indicative of potential account takeover where an adversary adds persistence or MFA bypass methods to a newly compromised account.
Detects an anomalous volume of artificial intelligence model inference API calls (e.g., AWS Bedrock, Azure OpenAI, Google Vertex AI) initiated by a single IAM principal or API key within a short time window. This activity is indicative of 'LLMjacking', where compromised cloud credentials are leveraged by threat actors to perform unauthorized, high-cost AI model inference tasks.
Detects command-line execution patterns that exhibit hallmark traits of LLM-generated code, such as overly verbose and explanatory comments, appearing alongside common obfuscation or decoding primitives (e.g., base64, iex, eval). This combination suggests the use of AI to assist in creating decoy logic or burying malicious payloads within legitimate-appearing scripts to evade detection.
Detects a two-stage activity: first, the potential unauthorized reading or access of LLM provider API keys from files, environment variables, or command-line arguments; and second, the subsequent use of those same credentials to authenticate to LLM provider APIs (OpenAI, Anthropic, Azure, Bedrock) from a different, unrecognized source IP address, indicating potential credential theft and session hijacking.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects command-line execution patterns that exhibit hallmark traits of LLM-generated code, such as overly verbose and explanatory comments, appearing alongside common obfuscation or decoding primitives (e.g., base64, iex, eval). This combination suggests the use of AI to assist in creating decoy logic or burying malicious payloads within legitimate-appearing scripts to evade detection.
Detects a two-stage activity: first, the potential unauthorized reading or access of LLM provider API keys from files, environment variables, or command-line arguments; and second, the subsequent use of those same credentials to authenticate to LLM provider APIs (OpenAI, Anthropic, Azure, Bedrock) from a different, unrecognized source IP address, indicating potential credential theft and session hijacking.
Detects a suspicious sequence of events where a user engagement (voice/video call) involving themes of urgency or helpdesk interaction is closely followed by a high-risk administrative action (e.g., password reset, MFA device enrollment, or financial transfer) by the same user, where the communication session context differs from standard activity, indicative of a deepfake-enabled vishing attack.
This rule correlates web clicks on Google Sites URLs containing keywords related to GlobalProtect with the subsequent creation or renaming of an unsigned or improperly signed GlobalProtect.msi file on the same endpoint within a 30-minute window. This behavior is indicative of a spearphishing attempt using a masqueraded landing page to deliver malicious or unauthorized software.
Detects outbound HTTPS connections to major generative AI inference endpoints originating from non-browser, non-development tool processes at regular intervals. This activity is indicative of beaconing behavior, where malware (specifically families like LAMEHUG) leverages LLM APIs for dynamic command generation, payload obfuscation, or C2 instruction retrieval, bypassing traditional security controls.
This rule detects potential prompt injection attacks against internal AI-powered assistants, agents, or LLM gateways. It monitors network HTTP requests for common patterns used to override system instructions, bypass safety filters, or force the model to adopt a privileged, unauthorized persona (e.g., administrator or debug mode). These techniques are often used in social engineering to manipulate the AI's output or security posture.
Detects potential runtime polymorphic malware that modifies its own executable or script content while simultaneously communicating with generative AI or LLM API endpoints. This behavior indicates an adversary using LLMs to regenerate obfuscated code or mutate malware signatures dynamically at runtime.
Single-source Sigma proxy for the authentication-persistence stage of the multi-stage device-code-phishing-to-Graph-collection chain (see the companion KQL correlation rule "Passkey Persistence: Device-Code Phishing to MFA Takeover and Graph Collection" for the full, threshold-gated, cross-table detection). Sigma has no join, temporal-windowing, or aggregation support, so this rule fires on the authentication-persistence event alone and does NOT enforce the device-code sign-in precursor or the subsequent Graph-activity burst - both required by the full correlation. Scoped to the two highest-signal operations only (new security-info registration, and any admin-initiated registration on another user's account) to cut noise from routine self-service profile edits.
Detects the creation of a process in a suspended state using the CREATE_SUSPENDED flag. This technique is commonly employed during process hollowing, process injection, or by legitimate security/debugging tools to prepare a process for memory modification before execution begins.
Page 80 of 864