Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.
Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.
This rule detects the creation or modification of Exchange inbox rules with highly suspicious or obfuscated names. Adversaries often create inbox rules with short, non-descriptive, or special character names (e.g., '.', '...', ';') to forward, redirect, or delete emails, facilitating data exfiltration or maintaining persistence. The rule specifically looks for rule names that are very short (less than 3 characters), empty, or match a predefined list of suspicious names.
Detects the execution of the TruffleHog secret scanning tool. This tool is often used by attackers to find sensitive information like credentials in various data sources (filesystems, Git repositories, cloud storage, etc.). This rule identifies the process creation of TruffleHog and categorizes the type of scan being performed. It includes exclusions for legitimate CI/CD environments or security scanners.
Detects process execution originating from the C:\ProgramData\log\ directory. This specific path is utilized as a staging directory by UNC6692 to execute their SNOWGLAZE tunneler and SNOWBASIN bindshell malware payloads.
Detects instances where a web browser (Chrome, Edge, Firefox, Brave, or Internet Explorer) launches 'ms-screensketch'. This activity is unusual as browsers typically do not directly invoke system utilities like Screen Sketch. This could indicate an attempt to capture screen content, potentially for data exfiltration or reconnaissance, or an unexpected browser behavior.
Detects instances where Windows screen capture tools (Snipping Tool or Screen Sketch) initiate network connections to external IP addresses on ports commonly associated with Server Message Block (SMB) or Common Internet File System (CIFS). This could indicate an attempt to exfiltrate captured screenshots to an external server.
Detects the execution of Windows Snipping Tool (SnippingTool.exe) or Screen Sketch (ScreenSketch.exe) when launched with the 'ms-screensketch' command-line argument. This behavior is indicative of a user or process taking a screenshot, which could be part of information gathering by an adversary.
Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows
Detects suspicious processes attempting to access Microsoft Teams local storage or cookies via command line parameters, a technique commonly used by info-stealers. The rule specifically looks for command line arguments targeting 'Cookies' or 'Local Storage\leveldb' paths within the Microsoft Teams directory, while excluding legitimate Teams executables to reduce false positives.
Detects the creation or modification of inbox rules that move messages to rarely checked folders like Archive, RSS Subscriptions, Conversation History, Junk Email, or Deleted Items. This is a common post-exploitation technique used to hide fraudulent communications (BEC, payroll fraud) or suppress security alerts, MFA notifications, and password reset emails from the victim. Approximately 10% of compromised accounts have malicious mailbox rules created shortly after initial access.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.
Detects delete action in the Github audit logs for codespaces, environment, project and repo.
Detects attempts to read raw disk data using mknod or dd, a technique observed in malicious npm packages to bypass permissions and extract secrets.
Detects the creation or modification of Exchange Online inbox rules, transport rules, or mailbox settings where the rule name consists exclusively of special characters. This pattern can be indicative of malicious activity, such as an attacker attempting to hide a forwarding rule or other automated action by using an obscure name.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Page 129 of 173