Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects processes frequently creating image files (bmp, png, jpg, jpeg) in temporary directories and subsequently initiating external network connections. The logic identifies suspicious patterns where a non-whitelisted process generates files at consistent, short intervals and performs network activity, which is a common indicator of automated screen capture and exfiltration.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Detects instances where browser processes (chrome.exe, msedge.exe, brave.exe, firefox.exe) access clipboard-related APIs via Sysmon Event ID 10. This behavior is indicative of potential malicious or unauthorized clipboard interaction, such as sensitive data harvesting or clipboard manipulation by automated agents or scripts.
Detects instances where browser processes (chrome.exe, msedge.exe, brave.exe, firefox.exe) access clipboard-related APIs via Sysmon Event ID 10. This behavior is indicative of potential malicious or unauthorized clipboard interaction, such as sensitive data harvesting or clipboard manipulation by automated agents or scripts.
Detects network activity associated with the BadBlocker for YouTube browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk). The rule identifies DNS queries and outbound network connections to known command-and-control (C2) domains (api.adblock-for-youtube.com, get.adblock-for-youtube.com) used by the extension to exfiltrate session cookies and other sensitive browser data.
Detects outbound network traffic from browser processes to known BadBlocker extension command-and-control infrastructure (api.adblock-for-youtube.com or get.adblock-for-youtube.com), followed by subsequent outbound HTTPS connections to arbitrary external domains. This sequence is indicative of malicious browser extension activity involving the exfiltration of session cookies or authentication tokens from the victim's browser.
This rule detects the outbound transmission of email attachments via SMTP (ports 25 and 587) that contain archived file formats (zip, 7z, tar.gz, tgz). Attackers often compress collected data into archives to facilitate exfiltration and minimize the time required for data transfer.
This rule detects the outbound transmission of email attachments via SMTP (ports 25 and 587) that contain archived file formats (zip, 7z, tar.gz, tgz). Attackers often compress collected data into archives to facilitate exfiltration and minimize the time required for data transfer.
This rule detects successful Azure AD authentication attempts originating from known hosting provider or VPS IP addresses, combined with anomalous behavior such as headless browser user agents, impossible travel, or high-risk sign-in flags. This pattern is indicative of Adversary-in-the-Middle (AiTM) phishing proxies like Evilginx or Bluekit, which attempt to bypass MFA by proxying the authentication process.
Detects anomalous browser activity where an endpoint retrieves configuration or scriptlets from the BadBlocker-related API, followed shortly by outbound network connections to suspicious domains or the exfiltration of sensitive browser-based session data like document.cookie, localStorage, or sessionStorage.
This rule detects the execution of processes named win_guard_*.exe or those residing in directories often used for malicious staging (Users\Public, Windows\Temp, ProgramData). Additionally, it detects when these identified suspicious processes load user32.dll, a common indicator of initiating a low-level keyboard hook (WH_KEYBOARD_LL) often used by keyloggers to capture user input.
Detects Android applications exhibiting multiple sensitive behaviors simultaneously within a 5-minute window, such as screen recording, audio capture, GPS tracking, and unauthorized access to SMS, call logs, or contacts. This behavior is strongly indicative of malicious mobile spyware.
This rule detects suspicious staging activity by monitoring for the creation of 'editor.dat' files in sensitive directories like C:\Users\Public or C:\Windows\Tasks, or the rapid accumulation of multiple executable files (.exe, .dll, .cpl) within the C:\Users\Public directory, which is a common technique used by attackers to stage tools before execution or lateral movement.
Detects unauthorized processes attempting to access or perform operations on sensitive files such as browser credentials, SSH keys, crypto wallets, and password manager databases. The rule specifically looks for non-standard or unsigned processes interacting with a high volume of these files in a short time frame, which is indicative of credential harvesting by infostealer malware like Lumma, Redline, or Vidar.
Detects unauthorized access (creation, modification, renaming, or deletion) to sensitive local credential files by the Node.js runtime process (node.exe/node). This behavior is indicative of infostealers, specifically noted in the Miasma/MYRA activity associated with the Polymarket Trap campaign, where malicious packages attempt to exfiltrate AWS, SSH, NPM, Python, Docker, and GPG credentials.
This rule detects when a Node.js process accesses sensitive files associated with cryptocurrency wallets (e.g., MetaMask, Phantom, Coinbase Wallet) or browser extension storage directories. This behavior is highly indicative of information-stealing malware attempting to extract private keys, wallet configuration files, or sensitive browser session data.
Detects periodic screen captures being written to the AppData\Roaming\Screenshots directory with specific timestamped naming patterns (time_YYYYMMDD_ or wnd_YYYYMMDD_) often used by Remcos RAT to exfiltrate user activity.
This rule monitors for suspicious file creation and process execution indicative of the Remcos Remote Access Tool. It specifically looks for the creation of files containing 'keylogger.dat' or 'logs' in the user's AppData directory, as well as the execution of processes with 'remcos.exe' or 'remcos' in the path or command line arguments, signaling potential keylogging or remote control activity.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
Detects the creation or writing of files within AppData directories matching specific naming patterns associated with Remcos RAT activity. Remcos typically generates files with a prefix of 'time_' or 'wnd_' followed by a timestamp string in these locations to store collected data or screenshots.
This rule detects when a user account repeatedly (3 or more times within an hour) requests either 'SeDebugPrivilege' or 'SeImpersonatePrivilege' (Event ID 4672). This behavior can be indicative of an attacker attempting to escalate privileges or manipulate access tokens, often seen in techniques like token impersonation or debugging processes for malicious purposes.
Page 93 of 173