Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects high-privileged Entra ID accounts successfully reaching the verification stage of the Self-Service Password Reset (SSPR) process. While SSPR is automatically enabled for administrative accounts, this activity is anomalous and potentially indicates an attacker focusing on discovered privileged accounts after performing broader enumeration.
Detects high-privileged Entra ID accounts successfully reaching the verification stage of the Self-Service Password Reset (SSPR) process. While SSPR is automatically enabled for administrative accounts, this activity is anomalous and potentially indicates an attacker focusing on discovered privileged accounts after performing broader enumeration.
Detects high-privileged Entra ID accounts successfully reaching the verification stage of the Self-Service Password Reset (SSPR) process. While SSPR is automatically enabled for administrative accounts, this activity is anomalous and potentially indicates an attacker focusing on discovered privileged accounts after performing broader enumeration.
Detects the use of tasklist.exe combined with process filtering (findstr) to identify common debugger names such as 'dbg.exe', 'x64dbg.exe', 'windbg.exe', or 'ollydbg.exe'. This technique is a known evasion tactic employed by the Kimsuky threat group (and others) to check for the presence of analysis tools before continuing execution of malicious batch scripts.
Detects the creation or modification of documents in common formats (e.g., .txt, .md, .docx, .pdf) that contain strings indicative of prompt-injection attempts. These strings are commonly used to manipulate the behavior of AI agents or Large Language Models (LLMs) that may process or index these files automatically.
Detects the creation of an NTFS Alternate Data Stream named ':changelist' on files with a .sys extension. This activity is indicative of potential malicious configuration staging or persistent storage, as seen in techniques involving BTR.sys or similar driver-based persistence mechanisms.
Detects the execution of BTR_CLI.exe with cleanup parameters that correlate with the deletion of specific registry keys (services) and related file artifacts (e.g., .dat or changelist files) within a short time window. This pattern is indicative of a post-compromise cleanup routine aimed at removing traces of malicious services or payloads.
Detects PowerShell command lines that perform suspicious string manipulation using the .Replace() method on specific obfuscated characters, followed by a Base64 decoding operation. This pattern is commonly used by attackers to reassemble and decode fragmented or obfuscated payloads on the fly to evade static analysis.
Detects instances where PowerShell is launched as a child process of WScript.exe or CScript.exe with suspicious command line flags intended to hide window visibility, bypass execution policies, or run in a non-interactive mode. This behavior is frequently used by adversaries to execute obfuscated or malicious scripts while minimizing user awareness.
Detects a process that deletes its own executable or script file within a short time window after launch, which is a technique used by some implants.
Detects a process that deletes its own executable or script file within a short time window after launch, which is a technique used by some implants.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects the execution of an installer file (.exe, .msi, .scr) located in common download or temporary directories that masquerades as a legitimate application (e.g., KeePass, Adobe Flash) or a medical document. The rule specifically identifies this behavior when it occurs within an hour of activity involving messaging applications like WhatsApp or Telegram, which is a known tactic in the 'CHOSEN BRICK' social engineering delivery chain.
Detects the loading of 'opencv_world4120.dll' by specific process names commonly associated with update activity (UpdateAssistant.exe, AppUpdateHelper.exe, SysMaintenance.exe) when the loaded DLL is either unsigned, untrusted, or has an invalid signature. This is indicative of potential DLL side-loading where malicious code is executed under the context of an ostensibly legitimate update process.
Detects modifications or creations of Azure DevOps pipelines and service connections, as well as pipeline executions performed outside of standard business hours (6 AM to 8 PM on weekdays). This activity is intended to identify potential unauthorized infrastructure or pipeline configuration changes that could indicate persistence or lateral movement via CI/CD pipelines.
This rule detects a correlation between a successful user login from an IP address not previously seen for that specific user in the last 14 days, followed immediately (within 1 hour) by sensitive administrative operations performed by the same user, such as adding members to roles or modifying application permissions.
Detects malicious code within the BTree.prototype.set function designed to trigger a secondary payload (sharedLoad.min.js) at runtime. This behavior is intended to bypass npm install-script scanning by embedding the logic within legitimate-looking library code and using Node.js child_process spawns with hidden parameters to maintain persistence and execution.
Detects modifications or creations of Azure DevOps pipelines and service connections, as well as pipeline executions performed outside of standard business hours (6 AM to 8 PM on weekdays). This activity is intended to identify potential unauthorized infrastructure or pipeline configuration changes that could indicate persistence or lateral movement via CI/CD pipelines.
Detects the creation of a suspicious scheduled task named 'MicrosoftMusicLibrariesPackageTaskMachine' and the execution of 'codeflush.exe' involving 'settingenv.cat'. These activities are associated with persistence and defense evasion techniques often used by malicious actors.
Detects instances of MSBuild.exe executing from within the Microsoft.NET framework directory while initiating outbound network connections to a specific known command-and-control (C2) IP address associated with rmrlx infrastructure, or standalone network activity matching these parameters.
Detects the use of Windows command shell variable substring expansion to obfuscate commands. Adversaries use this technique to build malicious command lines dynamically, making them less visible to standard keyword-based detection mechanisms by storing parts of strings in environment variables and reassembling them using substring notation (e.g., %var:~start,length%).
Page 85 of 864