Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects a suspicious sequence of events: a file named 'host.exe' being created in the Windows Startup folder, a 'runtime.zip' file being created in the local temporary directory, and subsequent network communication to the Telegram API (api.telegram.org) from the same device. This pattern is indicative of malware establishing persistence, staging data, and exfiltrating it via Telegram, potentially associated with malware like Small Sieve.
The rule detects the creation of processes that utilize specific mutex names associated with the Allcome clipper malware. Specifically, it looks for the mutex name '08841d-18c7-4e2d-f7e29d'. This indicates potential Allcome clipper activity on a Windows system.
Detects known mutexes associated with Keyzetsu Clipper activity. This rule specifically looks for the presence of a mutex named '2ILdX2JpexVZieT6mPv2i6Jp3HNFPlby' during process creation events on Windows systems.
Detects programmatic GitHub data exfiltration by identifying non-interactive repository exports, clones, artifact downloads, or gist staging performed using tokens, OAuth applications, or GitHub Apps. The detection focuses on bursty or multi-repository activity within a short time window, which can indicate automated source code collection, misuse of programmatic credentials, or post-compromise data extraction.
This rule detects the presence of environment variables used to control the malicious SANDWORM_MODE payload in CI environments or on local systems. The presence of these variables in a process command line is a strong indicator of an active infection or a workflow being manipulated by the malware's control logic.
Detects the execution of high-risk discovery or collection tools, such as vssadmin.exe, ntdsutil.exe, wevtutil.exe, certutil.exe, adfind.exe, dsquery.exe, klist.exe, or nltest.exe, when spawned by a BeyondTrust/Bomgar Remote Support session process (bomgar-scc.exe). This activity is indicative of post-exploitation behavior, potentially linked to intrusions described in CVE-2026-1731.
The rule detects the creation of a process that utilizes a specific mutex name, 'YourMutex'. This mutex name is associated with Atlas Clipper malware activity. The detection aims to identify potential Atlas Clipper infections by monitoring for this known indicator.
The rule detects the presence of specific mutex names ('7CmLQX') that are known to be associated with the Paradies Clipper malware. This indicates potential activity of the Paradies Clipper malware on the system.
Identifies successful Entra ID sign-ins using the Device Code Flow from a geographic location not seen for that user in the last 30 days. The device code flow involves two separate interactions (the attacker's device and the victim's browser), so a mismatch between the sign-in location and the user's established locations is a strong indicator of a session hijacking attempt.
Detects creation of the LunarApplication directory used by an infostealer to stage credential and cryptocurrency theft.
Detects Python executing pip installs for common Arkanix loader dependencies (requests, pycryptodome, psutil) as described in the report.
Detects the creation of files in specific staging directories used by the CRESCENTHARVEST malware for collecting keylogs, browser data, and Telegram sessions before exfiltration. The rule specifically looks for 'daT.txt' in 'spool\Drivers\color', and any file creation within '\Windows\Temp\sysdriver\' or '\Windows\Temp\tdata\'.
This rule detects suspicious enumeration of Azure Blob, File, Table, Queue, or DFS storage accounts by internal users. It identifies devices making network connections to public Azure storage URLs using potentially suspicious processes (e.g., PowerShell, Python, AzCopy, curl, wget, WinSCP, FileZilla, Storage Explorer). The rule then analyzes the distinct storage accounts accessed and uses a Jaccard index to identify unusual naming conventions among the accessed storage accounts, potentially indicating an insider attempting to discover or exfiltrate data from unfamiliar storage resources.
Detects the creation of JSON files within the '%LOCALAPPDATA%\Arkanix_lol\' directory. This folder is used by the Arkanix Stealer to stage stolen data before exfiltration, making this activity a strong indicator of infection.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit CVE-2026-20841 to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
Detects the creation or modification of Exchange inbox rules that move messages to potentially risky folders (e.g., Deleted Items, Junk Email, RSS Feeds, Archive, Clutter) or are configured to delete messages. This behavior can be indicative of an attacker attempting to hide malicious emails, exfiltrate data, or disrupt email flow.
Detects suspicious file staging activity in Temp directory structures commonly used for data exfiltration preparation. Includes credential folders, system information collection, and archive creation
Detects anomalous Exchange Transport Rule activity: high volume changes, suspicious patterns, or after-hours modifications
Detects file access or download activity from SharePoint or OneDrive where the user agent is PowerShell. This TTP has been associated with UNC6671 (related to ShinyHunters) for data exfiltration from SaaS applications.
Detects the DKnife gateway-monitoring framework, a toolset used by China-nexus actors for adversary-in-the-middle (AitM) attacks, based on specific file, network, and persistence artifacts.
The rule detects the creation of tar archive files (including .tar, .tar.gz, .tgz, and .tar.bz2) within common user-writable directories on Windows systems. Specifically, it looks for these archive files being created in paths containing '\Downloads\', '\Temp\', '\Public\', '\Desktop\', '\AppData\Local\Temp\', or 'C:\ProgramData\'. This activity could indicate data staging for exfiltration, where an attacker collects and archives data before moving it out of the compromised system.
Page 133 of 173