Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects potential credential harvesting and cryptocurrency wallet theft activities, specifically targeting browser data, SSH keys, cloud credentials, and crypto wallets. It looks for command-line patterns indicative of accessing or copying these sensitive files. The rule also includes a condition for Node.js processes attempting to exfiltrate credential-related data. The detection logic combines multiple conditions, such as browser credential access with SSH key theft, or cloud credential access with crypto wallet access, and Node.js exfiltration attempts combined with any of the credential/wallet access patterns.
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of distinct mailboxes belonging to other users. 2) Identifies users accessing a high number of distinct folders within another user's mailbox. Both parts are designed to flag potential unauthorized access, data exfiltration, or reconnaissance activities within an Exchange Online environment.
Detects network connections to domains associated with the DarkSpectre threat actor's campaigns, including GhostPoster, ShadyPanda, and The Zoom Stealer. These campaigns leverage malicious browser extensions for data theft, affiliate fraud, and corporate espionage.
This rule detects successful 'GetObject' operations on AWS S3 buckets originating from external IP addresses (not within common private IP ranges). This could indicate an attempt to exfiltrate data from S3 buckets by an unauthorized entity or compromised credential.
Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
This could indicate potential exploitation of the updater component to deliver unwanted malware.
This could indicate potential exploitation of the updater component to deliver unwanted malware.
Detects the initial VBScript loader used in Turla's Kazuar v3 campaign. The loader script (8RWRLT.vbs) is executed via wscript.exe and creates a folder structure mimicking HP printer drivers at %LOCALAPPDATA%\Programs\HP\Printer\Driver. The script downloads multiple files from a remote C2 server including hpbprndi.exe (a legitimate signed HP driver), hpbprndiLOC.dll (the actual Kazuar loader), and encrypted payload files (jayb.dadk, kgjlj.sil, pkrfsu.ldy). The loader uses WinHttp.WinHttpRequest.5.1 COM object to download files while ignoring SSL certificate errors, and establishes persistence by creating a registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. This rule specifically looks for wscript.exe processes with command lines containing both the HP printer driver path and hpbprndi references, which are strong indicators of the Kazuar v3 loader execution.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Detects RAT command structure
This rule detects Amazon S3 PutObject events where server-side encryption is performed using SSE-C (Server-Side Encryption with Customer-Provided Keys) or where the request uses Signature Version 2 (SigV2). SSE-C relies on the customer to manage encryption keys, which can introduce risks if not handled securely. SigV2 is an older, less secure authentication protocol for AWS requests and its use is generally discouraged in favor of SigV4.
Detects malicious browser extensions associated with the DarkSpectre 'Zoom Stealer' campaign by identifying known malicious extension IDs. The campaign uses these extensions for corporate espionage by stealing meeting intelligence from various video conferencing platforms.
This rule detects patterns indicative of an Evilginx-style Adversary-in-the-Middle (AiTM) phishing attack. It specifically looks for HTTP requests to hostnames ending in suspicious top-level domains (TLDs) such as .click, .online, .cloud, or .shop, combined with specific URI paths like /wlc/, /load/, or /success/. These patterns are commonly used by AiTM redirectors to capture credentials and session tokens.
Detects suspicious email inbox rule creation indicative of account compromise. Focuses on rules with randomly-generated names or rules that move emails to low-visibility folders combined with hiding actions (mark as read, delete, stop processing).
Detects the execution of AutoHotKey (.ahk) or AutoIt (.au3) scripts from common staging directories such as C:\Users\Public\ or C:\Temp\. This is a known technique used by malware like DarkGate to stage and execute its payload.
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
This detection identifies network connections to known first-stage Microsoft 365 phishing domains associated with an active Adversary-in-the-Middle (AiTM) campaign.
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
Detects anomalous Okta sign-on policy evaluations originating from Cloudflare, which could indicate an Adversary-in-the-Middle (AiTM) phishing attempt. The associated campaign uses Cloudflare to host its phishing infrastructure.
Detects a pattern indicative of an NTLM relay attack following an authentication coercion spray. The rule first identifies a single source IP generating a high volume of failed NTLM logon attempts across multiple critical servers in a short time. It then looks for a subsequent successful NTLM logon from that same source IP to a high-value target (like a Certificate Authority) using a machine account. This sequence is a strong indicator that an attacker coerced credentials and is now relaying them to escalate privileges.
Detects screenshot files being created in temp directories by Node.js processes. OtterCookie captures multi-monitor screenshots and stores them as JPEG files before exfiltration.
This detection rule identifies hosts where data archiving using 7-Zip is closely followed by network traffic to the temp.sh file-sharing service. This correlation suggests a potential data staging and exfiltration sequence, a TTP observed in the Lynx Ransomware campaign.
Detects Remote Procedure Call (RPC) attempts targeting critical assets, such as Domain Controllers, where the call includes a UNC path pointing to an external IP address. This is a strong indicator of an authentication coercion attack (e.g., PetitPotam, DFSCoerce) where an attacker is attempting to force the critical asset to authenticate to a listener they control to capture credentials.
Page 135 of 173