Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.
Detects access to SSL/TLS private key files by unauthorized processes
Detects use of forged web cookies for bypassing authentication
Detects fake Windows authentication prompts used to capture credentials
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule identifies the use of xcopy.exe with a combination of flags (/s, /e, /y, /c, /q, /h, /b) that are characteristic of NarwhalRAT's data staging activities from removable media.
Detects bulk file reading from network shares for data collection
Detects malicious script injection into HTTP responses via MitM
Detects unauthorized DHCP server responses indicating potential network compromise
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.
Detects the archiving (tar or zip) of .git directories. This activity can indicate an adversary attempting to exfiltrate full source code history and internal intellectual property.
Detects an untrusted process creating WAV or compressed audio files in a temporary path after loading multimedia capture components. This behavior is indicative of potential audio surveillance or data collection.
Monitors the Node package manager engine performing mass file reads of all .pub files in the SSH keys path. This rule specifically looks for 'node.exe' accessing multiple files ending with '.pub' within folders containing '.ssh'.
Detects PowerShell utilizing .NET Graphics classes to perform screen capture, specifically looking for the use of 'System.Drawing.Graphics', 'CopyFromScreen', and 'Bitmap' in the process command line.
Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.
Detects the extraction of a ZIP archive via tar.exe to the %TEMP% directory. This activity is often associated with malware unpacking or staging, where an adversary extracts malicious content into a temporary location for execution.
Detects unauthorized access to manufacturing process historian databases (OSIsoft PI, Honeywell PHD, Aspen IP.21) by non-engineering accounts from unexpected workstations. The rule correlates audit logs showing access to historian systems with sign-in logs for specific applications, identifying users with a high volume of access within a short timeframe.
This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.
Detects bulk cloning of GitHub repositories for source code collection
This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.
Detects copying of Outlook PST/OST files for email collection
Page 117 of 173