Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects HTTP POST requests containing common credential field names directed at files ending in .php (such as login.php, result.php, or index.php), which is highly characteristic of phishing kits used to harvest credentials.
Detects changes to SharePoint tenant-level or site-level sharing policies that expand external access to 'Anyone' (anonymous links) or 'ExternalUserAndGuestSharing'. Such modifications represent a significant security posture regression that may facilitate unauthorized data access or facilitate exfiltration pathways.
Detects the execution of known archival utilities (7-Zip or WinRAR) with command-line arguments indicative of file staging or compression, commonly associated with the collection and preparation of data for exfiltration.
Detects unauthorized processes attempting to access or perform operations on sensitive files such as browser credentials, SSH keys, crypto wallets, and password manager databases. The rule specifically looks for non-standard or unsigned processes interacting with a high volume of these files in a short time frame, which is indicative of credential harvesting by infostealer malware like Lumma, Redline, or Vidar.
Detects the installation of specific browser extensions in Microsoft Edge followed by network connection activity to external IP addresses. This behavior is indicative of potential malicious browser extensions, such as those used for browser session hijacking, credential theft, or command and control (C2).
Detects network communication to the malicious domain 'mitarchive.info' from common web browsers (Chrome, Edge, Firefox, Brave). This domain is associated with the StegoAd browser extension, which intercepts Google and WordPress login flows to exfiltrate stolen credentials and 2FA codes.
Detects file creation or modification events associated with the known malicious Chromium extension 'Search for perplexity ai' (ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for the installation of the extension and the creation of its declarativeNetRequest rule files (perplexity-rules.json, bing-rules.json, google-rules.json), which are used to hijack browser search queries and redirect them to a typosquatted domain.
This rule detects Adversary-in-the-Middle (AiTM) session hijacking against Microsoft 365, specifically targeting the Tycoon 2FA phishing kit (associated with campaigns like Payroll Pirate). It correlates two distinct malicious behaviors: the initial MFA capture phase (involving specific error codes and spoofed user agents) and subsequent illicit token replay against the Microsoft Graph API from unmanaged devices.
Detects non-Steam processes accessing Steam configuration files (e.g., config.vdf, loginusers.vdf, ssfn files) and reading Steam-related registry keys. This behavior is indicative of infostealer malware attempting to hijack Steam sessions or exfiltrate account configuration data.
Detects the execution of known adversary-in-the-middle (AiTM) phishing frameworks, such as Evilginx or Modlishka, by identifying process names, paths, or specific command-line arguments (e.g., --phishlets, --proxy, --lure) used to initiate these proxy-based phishing sessions.
Detects unauthorized processes (those not identified as standard web browsers) accessing browser profile directories (Local Storage or IndexedDB) associated with major AI platforms such as OpenAI, ChatGPT, Anthropic, and Copilot. This behavior is indicative of credential theft or session token exfiltration from local browser storage.
Detects execution of SharpHound (BloodHound) for Active Directory enumeration and subsequent exfiltration of collected datasets, specifically tracking activity attributed to the MexicanMafia (Operation Escaneo).
This rule detects the creation or modification of specific files associated with known malicious activity or remote access tools, specifically looking for shortcut files (LNK) named 'ApplianceConfig', 'ServerConfig', 'CredentialsConfig', or AnyDesk configuration files ('anydesk_svc.conf', 'anydesk_usr.conf'). These file patterns are often used by threat actors for persistence or to facilitate remote control.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
This rule detects activity associated with known Android Remote Access Trojans (RATs) such as BTMOB, CraxsRAT, CypherRAT, and SpySolr on SentinelOne-managed Android devices. It flags suspicious file creations (sideloaded APKs in user storage), specific malicious process names, SentinelOne threat indicators, and abuse of accessibility services for unauthorized remote control, keylogging, or screen overlay activities.
Detects process activity indicative of keylogging by the Remcos RAT loader. The rule specifically looks for processes with 'Remcos' or 'GST*.com' in their file name that also contain command-line arguments related to capturing window text or foreground window information, which are common keylogger behaviors.
This rule detects when processes other than known web browsers (Chrome, Firefox, Edge, Opera) attempt to access sensitive browser-related files such as 'Login Data', 'Cookies', and database files. It specifically flags instances where the accessing process or its parent process originates from 'C:\ProgramData' or where the parent process is 'powershell.exe', which is a common pattern for malicious credential access tools.
Detects a process that is not a standard office, browser, or system application accessing a high volume of document files (doc, docx, pdf, xlsx, xls, pptx, txt, odt) within user directories over a short time window. This behavior is indicative of potential automated file collection or data staging by unauthorized processes.
Detects a specific sign-in sequence indicative of a Payroll Pirate adversary-in-the-middle (AiTM) attack. The pattern involves a Microsoft Outlook interactive sign-in resulting in a 50199 error (Login:reprocess) followed within 10 minutes by a Cmsi:cmsi authentication attempt, both originating from the same user and the specific user-agent Firefox 142.0. This behavior is associated with 2FA proxying techniques where the attacker captures and replays session information.
This rule detects failed Microsoft 365 sign-in attempts on the OfficeHome application associated with error code 90014, indicating a malformed or missing credential payload. The detection specifically triggers when these failures originate from an iPhone/iOS user-agent. This behavior is indicative of the reconnaissance phase of the Payroll Pirate campaign (associated with threat actor Storm-2755), where attackers use mobile-simulated browsers from carrier IP ranges to probe authentication endpoints before deploying Adversary-in-the-Middle (AiTM) kits.
Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.
Page 89 of 173