Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects the execution of self-extracting archives (SFX) that are commonly used by malware to launch a visible decoy and a hidden executable from a temporary directory. It specifically looks for process launch events where the command line contains keywords associated with SFX archives (e.g., '7-zip', 'sfx', '-y', '-o') and the principal process's file path contains terms like '7z', 'sfx', 'setup', or 'installer'. The rule aims to identify the initial stage of an attack where an SFX archive is used to drop and execute malicious payloads.
Detects modification of scripts in extension folders.
This rule detects when the Internet Information Services (IIS) worker process (w3wp.exe) accesses sensitive files such as 'web.config', 'applicationHost.config', or 'win.ini'. Unauthorized access to these files by the IIS process can be an indicator of a web shell or other malicious post-exploitation activity attempting to steal credentials, application secrets, or system configuration information.
Detects cloud searches for sensitive keywords (credential, secret, etc.) followed by access to matching files.
Detects rapid screenshot capture and image encoding by a non-support process for live remote viewing, indicative of a Remote Access Trojan (RAT) like Banana RAT. The rule specifically looks for process command lines containing functions related to screen capturing (CopyFromScreen, BitBlt, Graphics.CopyFromScreen) and image encoding/streaming (JPEG, Bitmap, stream, frame, socket).
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
Detects attempts to leverage PowerShell to register a loose-file AppX package from a UNC path. This technique can be used to trigger NTLM coercion via InstallService.exe or achieve SYSTEM DLL load, often associated with the 'UNCanny' coercion method. The rule looks for PowerShell command lines containing 'Add-AppxPackage', '-Register', and a UNC path (\\) along with 'AppxManifest.xml'. Additional suspicious indicators like '-ExecutionPolicy Bypass', 'DiscCoerceProbe', 'poc.ps1', 'Invoke-InstallServiceCoerce.ps1', or '-AttackerHost' increase the suspicious score.
Detects suspicious activity indicative of CryptoBandits malware, specifically JScript stealer polling the clipboard and beaconing actions. This rule identifies instances where wscript.exe or cscript.exe spawn clip.exe (for clipboard access), curl.exe (for C2 communication via Tor SOCKS5 with specific keywords like 'REPL', 'SEED', 'PKEY'), or cmd.exe within a staging directory like 'Public\Documents'. It also looks for specific filenames in the command line such as 'exefu.js', 'ofolu.js', 'words.txt', or 'ugate.exe'.
Detects activity associated with Operation Poisson credential theft, specifically the use of VBScript (sys.vbs) to launch a Python keylogger (pynput or keyboard library) or the installation of keylogger dependencies via pip. It also includes a hash match for a known artifact (KeyL.zip).
Detects a high number of office, PDF, text, and archive files created or renamed in the Downloads or AppData Roaming folders by a single process within a fifteen-minute window. The detection is triggered if either 25 or more files are created/renamed, or if the total size of these files exceeds 500 MB.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
This rule detects processes that load sensitive Windows multimedia and graphics modules (mmdevapi.dll, avrt.dll, magnification.dll, dxgi.dll) which are commonly utilized for audio recording and screen capturing. The rule filters out known legitimate applications (e.g., Teams, Zoom, Web browsers) and trusted software publishers. It further identifies potential suspicious activity by flagging processes originating from common staging paths like 'Temp', 'Downloads', or 'ProgramData' and instances where the process image is unsigned.
This rule detects potential Animateclipper malware or similar cryptocurrency clipboard hijackers by identifying the presence of Windows API calls related to clipboard manipulation (GetClipboardData, SetClipboardData) in conjunction with regular expressions for common cryptocurrency addresses (Bitcoin, Ethereum) and the keyword 'clipboard'. The rule triggers if at least three of these indicators are present, suggesting an attempt to monitor and replace cryptocurrency addresses copied to the clipboard.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
This rule detects potential mass email collection activity over IMAP (port 143). It triggers when a client sends a 'FETCH' command followed by 'BODY[]' content at least 20 times within 60 seconds from the same source IP address. This behavior is indicative of an adversary attempting to download a large number of email bodies, which is a common method for email collection.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is associated with the 'protocal.cjs' backdoor from the easy-day-js supply chain attack, which aims to exfiltrate sensitive browser data.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Identifies the AMOS stealer validating and redirecting the captured plain-text macOS password into a hidden .pass file.
Time-series correlation identifying the powershell process rapidly scraping browser extensions and local storage files. This rule detects suspicious file access patterns where a process rapidly accesses multiple files within browser-related folders (Local Extension Settings, Network Persistent State, Cookies, Login Data). A count of more than 5 unique file accesses within a one-minute window by the same process on the same device triggers the alert.
Page 109 of 173