Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects use of custom encoding methods to archive data for exfiltration
Detects use of custom encoding methods to archive data for exfiltration
Detects malicious script injection into HTTP responses via MitM
This rule detects rapid access to specific classified document types (.doc, .docx, .pdf, .xls) followed by network egress to identified C2 structures within a 5-minute window. It correlates file access events for sensitive document types with subsequent network connections initiated by the same process on the same device.
This rule specifically flags the creation of executable files (.exe) in the unusual C:\Users\Public\Documents\ path, which is often used by malware for staging purposes, as observed in Operation Silent Rotor. The detection looks for a specific naming convention of 6 alphanumeric characters followed by '.exe'.
Detects PowerShell attempting to hook keystrokes via user32.dll SetWindowsHookEx. This behavior is often associated with malware like PS1Bot to capture user input.
This rule detects processes that exhibit behavior consistent with XWorm RAT's clipboard hijacking capabilities. It identifies processes making persistent OpenClipboard API calls or showing unusual access patterns to clipboard-related registry keys, specifically looking for modifications to the 'Run' registry key with data containing 'xworm', 'clipboard', or 'clip'. Common legitimate processes are excluded to reduce false positives.
This rule detects a high volume of HTTP requests to Salesforce API endpoints associated with bulk data queries. Specifically, it looks for 20 or more requests within a 60-second window from a single source IP to 'salesforce.com' with URI paths containing both '/services/data/' and '/query/'. This pattern suggests a potential bulk download of customer records or other data via the Salesforce API.
Detects the use of the Windows built-in 'tar' utility to extract files into the C:\Users\Public\AccountPictures directory. This behavior has been observed in APT37 NarwhalRAT campaigns during its setup phase, indicating potential ingress tool transfer or staging of malicious files.
This rule detects the creation of files named 'lgf.dat' or 'lg.dat' within a user's Microsoft Vault directory. These file names and location are associated with keylogger activity, specifically as observed in the 'Fishmongers' Arsenal' campaign involving SprySocks malware.
This rule detects the execution of self-extracting archives (SFX) that are commonly used by malware to launch a visible decoy and a hidden executable from a temporary directory. It specifically looks for process launch events where the command line contains keywords associated with SFX archives (e.g., '7-zip', 'sfx', '-y', '-o') and the principal process's file path contains terms like '7z', 'sfx', 'setup', or 'installer'. The rule aims to identify the initial stage of an attack where an SFX archive is used to drop and execute malicious payloads.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Oversized Executable Created by Archiver
Cortex XDR
This rule detects the creation of an executable file with an unusually large size by common archiving utilities such as 7-Zip, WinRAR, tar, or PowerShell extraction. The rule focuses on the causality chain to identify the process responsible for creating the oversized executable, which can be indicative of malware packing or other suspicious activity.
This rule detects the creation of specific files (lgf.dat or lg.dat) within a user's Microsoft Vault directory, which are indicative of keylogger activity. The rule leverages Cortex XDR data to provide causality and actor information for investigation.
Detects bulk export of Confluence wiki content
This rule detects suspicious process creations where the command line contains keywords indicative of keylogger activity (e.g., 'keylog', 'keystroke', 'inputmanipulator', 'spyware') combined with installation-related keywords (e.g., 'install', 'create', 'load', 'run'). It aggregates these events by computer and user over one-hour intervals to identify potential keylogger installation attempts.
Detects rapid clipboard monitoring and substitution behavior via PowerShell APIs.
Detects hollowed MsBuild process accessing Discord or Crypto wallet files.
This rule detects the use of the 'ditto' command-line utility on macOS for data staging and compression, specifically looking for executions that use compression flags (-c, -k) and target the /tmp/ directory. This behavior is indicative of information stealer malware like Amos Stealer, which may compress collected data before exfiltration.
Detects the simultaneous creation of .pkg_history and .pkg_logs in a temporary directory, indicating the setup.cjs dropper associated with the Mastra NPM supply chain attack.
Detects the creation or modification of directories named 'logs', 'persistantstorage', or 'scratchpad' within paths related to PeopleSoft PSEMHUB. This activity could indicate an attacker staging data or setting up persistence, as observed in campaigns like ShinyHunters targeting the education sector with Oracle exploits.
Page 116 of 173