Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit a vulnerability (e.g., CVE-2026-20841) to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
Detects command-line activity containing keywords related to API hooking (e.g., SetWindowsHookEx, hook, inline, trampoline) initiated by common scripting interpreters like powershell.exe, cmd.exe, or rundll32.exe. This pattern is often associated with malware attempting to inject code or capture data by intercepting process function calls.
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
Detects processes associated with Remcos RAT attempting to perform activity logging or idle time monitoring by looking for specific command-line arguments related to window and idle state functions, combined with process names or command lines containing 'Remcos'.
Correlates PowerShell invoking the download of 7za.exe to extract the hidden payload out.7z. This rule specifically looks for instances where '7za.exe' is executed with 'out.7z' in its command line, and this execution is preceded by 'powershell.exe' with '7-zip.org' in its command line on the same device. This pattern is indicative of the UnregStealer malware's method of extracting its payload.
Detects network events where a device communicates with the 'urlzzz.php' endpoint, specifically when this communication is correlated with file events involving 'Login Data' or 'Cookies'. This indicates potential exfiltration of browser credentials or session information by the UnregStealer malware.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
Detects IDE processes creating ZIP archives in temporary directories, which can indicate exfiltration of cryptocurrency wallets. The rule specifically looks for 'Code.exe' (VS Code) or 'cursor.exe' creating '.zip' files in common temporary paths like 'AppData\Local\Temp' or '/tmp/'.
Detects a banking trojan (Banana RAT) attempting to intercept or replace PIX QR payment data from the clipboard, browser, or screen content. The rule looks for processes with names indicative of the RAT (banana, client, update, service) and command-line arguments related to PIX, QR codes, or clipboard manipulation.
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
Detects the execution of a PowerShell script named 'sp.ps1' which has been associated with the Seedworm (also known as Sandworm Team) threat group for gathering screenshots. This rule specifically looks for 'sp.ps1' within process command lines.
Detects the execution of rar.exe with command line arguments indicating the creation of a new archive (-a) and the use of the -k switch. The -k switch in RAR is often used to lock an archive, preventing further modifications, which is a technique sometimes used by adversaries to preserve staged data for exfiltration.
Detects the use of WinRAR (rar.exe) to archive files using command-line arguments indicative of data staging or exfiltration (such as continuous archiving or specific extraction flags). The rule focuses on executions originating from suspicious parent processes like web servers (w3wp.exe) or command shells, or occurring within sensitive directories such as backup locations or VMware application folders.
Identifies the active use of keyboard/mouse input simulation APIs from within the TencShell process memory, specifically when the initiating process is 'setup.exe'. This behavior is indicative of an attacker simulating user interaction.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.
Detects the execution of 'rar.exe' with specific command-line arguments indicative of file archiving or extraction (using switches like '-k', '-r', '-s', '-t', '-o-p'). The rule monitors for instances where this activity originates from a web server process (w3wp.exe) or command interpreter (cmd.exe), or involves specific sensitive paths like backups or VMware configuration directories, which may suggest unauthorized data staging or exfiltration preparation.
This rule detects potential command and control (C2) communication by monitoring for connections to known malicious domains or IP addresses and identifies the creation of suspicious staging files (specifically 'debug.txt') commonly used to collect or exfiltrate data.
Detects a non-browser process creating copies of at least three Chromium credential or browsing databases in a temporary, roaming, public, or program-data directory. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Page 111 of 173