Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects bulk download of Slack messages using the API
Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.
Detects the use of 'curl' with '-X PUT' and '--data-binary' options, which can indicate data exfiltration or staging activities. This combination is often used to upload raw data to a specified endpoint.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs and flags potentially malicious user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node). It also categorizes user agents by risk level (HIGH, MEDIUM, NONE) and extracts relevant details like device IDs, IP addresses, and chat information. This activity can indicate post-compromise attackers using stolen tokens to silently export chat history.
This rule detects potential session token replay attacks against Okta by identifying a single Okta session (externalSessionId) being used from multiple distinct origins. It specifically looks for divergence in device identity (dtHash), operating system (OS), or client country within the same session, rather than just multiple IP addresses. This behavior is indicative of a stolen post-MFA cookie being replayed by an attacker.
This rule detects potentially malicious data exfiltration activity. It identifies sequences of events where a process performs file enumeration (directory listing), followed by the creation of a ZIP or RAR archive in temporary or local application data directories with randomized filenames. Finally, it correlates this behavior with subsequent outbound network connections from the same process to known cloud storage and file-sharing providers, flagging anomalous archive creation rates.
This rule detects potential Adversary-in-the-Middle (AiTM) session hijacking by monitoring for successful multi-factor authentication (MFA) events on unmanaged or non-compliant devices, followed within 30 minutes by an API request from a geographically distant location. It includes logic to flag suspicious User-Agent strings often associated with automated AiTM tools.
Detects the creation of multiple sequential screenshot files (JPG or BMP) within the C:\Users\Public\Videos directory. This activity is consistent with the SIGHTGRAB tool utilized by UNC1549 for visual intelligence collection.
This rule detects potential data staging activities by monitoring for specific file paths and filenames associated with unauthorized collection of sensitive data (such as VPN configs, password databases, and office documents). It triggers when processes not typically associated with these file types access or interact with sensitive directories and file extensions.
Detects browser-based network connections to URLs containing Google or Gmail branding where the resolved IP address does not match the expected Google IP address prefixes. This behavior is indicative of an Adversary-in-the-Middle (AiTM) phishing attack, where a user is being redirected to a malicious proxy server that mimics the legitimate Google login service to intercept credentials and MFA tokens.
Detects the creation of specific file paths or ZIP archives in the user profile indicative of the GIFTEDCROOK information stealer staging collected data for exfiltration.
Detects the use of WinRAR or rar.exe to archive sensitive web directory content (e.g., wwwroot, web.config, database files) when spawned from web server processes like w3wp.exe or cmd.exe. This behavior is indicative of data staging for exfiltration, a common tactic for actors like those associated with the CL-STA-1062 intrusion campaign.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Ransomware group exploiting edge devices and managed file transfer software
Detects Yuta/Glove Stealer malware attempting to establish persistent WMI event subscriptions for keylogging. This is identified by the execution of wmic.exe or PowerShell to register event filters, consumers, or bindings, initiated by suspicious parent processes such as winupdate.exe or processes originating from temporary/staging directories.
This rule monitors for the loading of 'avicap32.dll' by processes that are not typically associated with video or audio conferencing and recording. 'avicap32.dll' is a legacy Windows library used for capturing video, often abused by malware to secretly access webcams for surveillance purposes. By filtering out known legitimate applications (e.g., Zoom, Teams, OBS, Skype), this rule flags potential unauthorized access to video capture capabilities.
Detects processes attempting to load multimedia DLLs or access video capture devices that are not associated with authorized communication, media, or browser applications. This logic identifies potentially malicious attempts to capture video feeds from local cameras.
Detects periodic image file creation (e.g., .bmp, .png, .jpg) in user-writable temporary or application data directories by non-UI processes. This pattern is consistent with the behavior of remote access trojans (RATs) such as Atlas RAT and Gh0stRAT, which capture screenshots and stage them for exfiltration.
Detects unauthorized webcam usage by monitoring for the loading of avicap32.dll by non-standard processes. This behavior is indicative of the Atlas RAT, which leverages the avicap32 library to perform illicit video surveillance on compromised hosts.
Clipboard hijacking malware for cryptocurrency address substitution
This rule detects the creation or modification of inbox rules in Office 365 that involve email forwarding or redirection to external domains. It calculates a risk score based on whether the action occurred outside of typical business hours (08:00-18:00 local time/weekends) and whether the user is performing this action from a previously unseen IP address, which may indicate a compromised account attempting to exfiltrate or redirect emails.
Page 85 of 173