Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects PowerShell invoking Add-Type to compile C# code inline, indicative of PS1Bot malware. Specifically looks for the use of 'Add-Type' in PowerShell command lines combined with specific C# methods like 'SetWindowsHookEx', 'Graphics', or 'CopyFromScreen', which are often used for screen capture or other malicious activities.
Detects the creation of localized staging directories with suspicious names in public paths, used to temporarily hold compressed data before exfil. The rule specifically looks for folder creations under 'C:\Users\Public\' with names like 'Exfil', 'Data', 'Staging', or 'Dump'.
Detects the AMOS Stealer archiving collected data using the 'ditto' command with specific flags and output file names. This rule identifies the use of '-c', '-k', and '--sequesterRsrc' flags, along with '/tmp/osalogging.zip' or '/tmp/out.zip' as target archive names, which are characteristic of AMOS Stealer's data staging and archiving behavior.
This rule detects when 'pythonw.exe' performs a high volume of distinct database file reads (5 or more) within a 3-minute window. This behavior is indicative of potential credential harvesting or data exfiltration by malicious Python scripts, as described in the referenced blog post about threat actors using AI hype in social engineering campaigns.
Detects the creation of archive files (ZIP, 7z, RAR, TAR, GZ) within common user staging directories such as Downloads, AppData Roaming, Desktop, or Temp folders. The detection specifically targets archives created by command-line shells (cmd, PowerShell), dedicated archiving utilities (7z, WinRAR, tar), or remote access tools (AnyDesk, Bomgar, ScreenConnect, Splashtop, Atera). This activity is indicative of data staging prior to exfiltration.
Detects bulk export of CRM customer data for collection and theft
Hunts for the malware compressing the collected host and browser data into a temporary .zip file prior to network exfiltration. Specifically looks for file creation events of .zip files with a specific naming convention (8-15 alphanumeric characters) in common temporary directories, initiated by 'AutoIt3.exe'.
Detects a module writing command results, screenshots, file listings, or collection output into a dedicated hidden working directory. This rule specifically looks for file creation events (EventCode 11) in common temporary or application data directories, where the filename matches a pattern indicative of staged results (e.g., 'result', 'output', 'jobs', 'tasks', 'stage' followed by common data file extensions).
Detects a new mailbox rule that deletes, moves, redirects, or marks as read messages containing security, sign-in, MFA, alert, or administrator terms. This behavior is often indicative of an adversary attempting to hide their activities or prevent detection by preventing security notifications from reaching the user.
Identifies the hallmark behavior of AgentTesla (frequently delivered via tax lures) injecting into RegAsm and attempting SMTP/FTP exfiltration.
Correlates the creation of randomized staging directories /tmp/shub_ indicating SHub Stealer activity.
Detects the creation of specific staging paths utilized by AMOS to organize stolen artifacts before archiving.
Detects ARP poisoning via gratuitous ARP responses for MITM attacks
Detects files or processes matching SHA256 indicators published by Google Threat Intelligence Group for the INFINITERED campaign. The hashes cover the help.php persistence component, credential harvesters, backdoors, and droppers. A match should be treated as a high-confidence indicator of compromise and investigated immediately.
This rule detects a suspicious sequence of events indicative of ransomware activity, specifically the Prinz Eugen ransomware. It looks for the execution of common file compression utilities (7z.exe, rar.exe, WinRAR.exe, winzip.exe) followed by the execution of known ransomware encryption executables (servertool.exe, encrypt.exe) on the same device within a 30-minute window. This pattern suggests that an attacker is compressing files before encrypting them, a common tactic to reduce the size of data for faster encryption or exfiltration.
Detects one-way C2 communication via data drops to cloud storage services
Detects the creation of 'Screenshot.jpg' in the AppData directory by PowerShell. This activity is often associated with malware like PS1Bot attempting to capture screenshots of the user's desktop.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
Detects unauthorized DHCP server responses indicating potential network compromise
Detects ARP poisoning via gratuitous ARP responses for MITM attacks
Page 114 of 173