Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Detects a non-browser process reading active browser titles, URLs, or accessibility trees and matching Brazilian bank names before activating fraud modules. Specifically, it looks for processes named 'banana', 'client', 'update', or 'service' (case-insensitive) that are executing commands related to UI automation or window title retrieval, and simultaneously searching for banking-related keywords like 'bank', 'internet banking', 'agencia', or 'conta'.
This rule detects a potential data collection or exfiltration attempt in Microsoft Teams by identifying accounts that have accessed an abnormally high number of messages (more than 100 within a 5-minute window). This behavior may indicate an automated process or a compromised user account attempting to scrape internal communications.
This rule detects a potential data collection or exfiltration attempt in Microsoft Teams by identifying accounts that have accessed an abnormally high number of messages (more than 100 within a 5-minute window). This behavior may indicate an automated process or a compromised user account attempting to scrape internal communications.
Detects a game launcher writing a new executable beneath AppData or the user profile, which is unusual for signed platform updates and may represent RokRAT or BirdCall staging. This rule specifically looks for file creation events where the file is an executable (.exe), the path is within a user's AppData, Documents, or Downloads folder, and the creating process is identified as a game, launcher, update, or patch executable.
Detects the use of common archive utilities (tar, zip, 7z) by the Bomgar remote support service process (bomgar-rep.exe or bomgar-scc.exe). This pattern is often associated with post-exploitation data staging where an attacker compresses internal files prior to exfiltration.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
This rule detects processes that load sensitive Windows multimedia and graphics modules (mmdevapi.dll, avrt.dll, magnification.dll, dxgi.dll) which are commonly utilized for audio recording and screen capturing. The rule filters out known legitimate applications (e.g., Teams, Zoom, Web browsers) and trusted software publishers. It further identifies potential suspicious activity by flagging processes originating from common staging paths like 'Temp', 'Downloads', or 'ProgramData' and instances where the process image is unsigned.
Photo-themed ZIP phishing campaign dropping a Node.js implant
AI-powered phishing-as-a-service abusing device-code authentication
Credential and browser data stealer distributed via OXLOADER campaigns
Flags traffic targeting known rogue DNS infrastructure IPs associated with recent SOHO router hijacking campaigns. This rule specifically looks for outbound network connections to IP addresses starting with '5.' or '185.' on destination port 53 (DNS).
Detects the creation of multiple archive files (ZIP, 7Z, RAR, TAR) by common utilities (7z, WinRAR, tar) in sensitive temporary directories (Temp, tmp). The rule aggregates activity over a 10-minute window to identify suspicious staging behaviors often associated with ransomware data preparation.
This rule detects when processes other than legitimate browser-related binaries access Google Chrome's 'Login Data' or 'Local State' files. These files contain sensitive browser data, including stored credentials, and unauthorized access is a common indicator of credential theft or dumping attempts by malicious software.
This rule detects suspicious file activity involving Alternate Data Streams (ADS) and file names containing 'WDFOO' or 'wermgr.exe' within specific 'RP_' staging directories. Such activity is often associated with file-based staging, persistence, or potential obfuscation techniques using NTFS streams.
Detects the loading of the 'avicap32.dll' (Video Capture API) module by processes that are not recognized as legitimate media, conferencing, or streaming applications. This behavior is often associated with remote access tools (RATs) like Atlas RAT, which may use this library to covertly capture video from a webcam.
Detects processes executing from user-writable directories (e.g., Temp, AppData, Downloads) that create files in Temp or AppData directories, specifically excluding common browser processes. This behavior is consistent with the post-exploitation activity of remote access trojans (RATs) such as Atlas RAT or Gh0stRAT, which may log keystrokes to a local file.
Commodity .NET keylogger and remote access trojan
Detects suspicious credential harvesting activities, specifically identifying processes performing a sweep of multiple sensitive configuration files (e.g., AWS, Kubernetes, SSH keys, npm, git) or processes accessing /proc/self/environ to enumerate environment variables for sensitive data.
Clipboard hijacking malware for cryptocurrency address substitution
Page 101 of 173