Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects the presence of file artifacts associated with known keyloggers (keylogger.dat, remcos.log) or files containing 'keylog' within the AppData\Roaming directory, which is a common persistence location for malware.
Detects instances where a node.exe process accesses common configuration, credential, or authentication files. Adversaries may leverage Node.js scripts or malicious applications to exfiltrate sensitive data such as SSH keys, AWS credentials, Docker configurations, or git configurations.
Detects the loading of the avicap32.dll library (often used for webcam/audio capture) by unexpected processes, or any file access activity within the 'C:\MicRecords\' directory, which may indicate unauthorized surveillance or credential/audio harvesting.
Detects the presence of Remcos RAT executable files or the creation of screenshot files by non-standard processes, commonly used for remote surveillance.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
This rule detects infostealer activity involving desktop screenshot capture and clipboard monitoring, which are common tactics used by the StealC infostealer family to harvest sensitive information. The detection triggers when known StealC binaries execute or when native Windows utilities like the Snipping Tool or PSR are launched by suspicious parent processes associated with this malware.
Detects the macOS.Gaslight Python collection module compressing staged data into a ZIP archive (collected_data.zip) using shutil.make_archive for subsequent exfiltration over Telegram C2. The module calls compress_output() which archives browser credentials, keychain, terminal history, and process snapshots into temp/collected_data.zip.
Detects the execution of Impacket tools from a specific portable bundle path ('mini_imp/') often utilized by the threat actor MexicanMafia during 'Operation Escaneo'. The activity involves Active Directory enumeration and reconnaissance of service accounts, including those associated with SQL services, Citrix administrators, and CyberArk vault operators.
Detects anomalous activity originating from Oracle database processes, including the spawning of shell commands via DBMS_SCHEDULER, execution of known attacker staging scripts, and the creation of sensitive output files in temporary directories, which are characteristic of database-level remote code execution or exfiltration attempts.
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
Detects a sequence of activity where WinRAR is used to archive data, followed by the use of WinSCP to potentially exfiltrate that data, occurring on the same host within a 24-hour window.
Detects WinRAR executing with archiving flags (create, add, move) on sensitive paths, followed by an outbound network connection to a non-private IP address within a 10-minute window, which is characteristic of data staging and exfiltration.
This rule detects the staging of data using WinRAR, followed by potential exfiltration to known public file-sharing services (easyupload.io, anonfiles.com, gofile.io, transfer.sh) within a 2-hour window. It monitors for either DNS requests to these domains or the execution of web browsers or common command-line tools (curl, wget, PowerShell) with these domains in the command line arguments following WinRAR usage.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.
Detects potential Browser-in-the-Middle (BitM) session hijacking by identifying scenarios where a single user account authenticates successfully from multiple geographically distinct external IP addresses within a short (10-minute) window, suggesting a parallel session is being used by an attacker.
Detects anomalous, high-frequency bidirectional WebSocket connections (wss/ws) originating from an endpoint that match patterns associated with Bluekit BitM. These connections typically carry DOM serialization events (rrweb-style) and session handshake data, indicative of a victim's keystrokes and mouse movements being relayed to an attacker-controlled browser session.
Detects suspected Browser-in-the-Middle (AiTM) activity by identifying successful multi-factor authentication followed by session activity from a different source IP address or with a different user-agent string within a 10-minute window, suggesting token theft or session hijacking.
Page 105 of 173