Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects a multi-stage attack chain where an AI-agent's configuration file (e.g., mcp.json) is modified, followed immediately by the execution of a tool process (node/python) spawned by the agent, the subsequent spawning of a shell process, and finally an outbound network connection to a rare, non-standard domain. This sequence is indicative of AI agent tool poisoning, where malicious tool definitions are introduced to execute arbitrary commands and exfiltrate data. Coverts T1195.002, T1565.001, T1059
Detects the loading of the malicious NvFsFilter driver (a BYOVD technique often used by the Rapuncel infostealer) followed immediately by a mass burst of process terminations, indicating an attempt to disable security software.
Detects rapid, large-scale deletion of Azure storage accounts by a single identity within a short timeframe. This behavior is indicative of destructive activity, such as a malicious actor attempting to disrupt service availability or impact organizational data, rather than typical administrative teardown.
Detects anomalous, oversized fragmented UDP traffic (exceeding 1400 bytes) targeting or originating from the MikroTik btest service port (2000). This behavior is indicative of attempts to trigger integer underflows, system crashes, or uninitialized memory disclosures within the btest protocol implementation.
Detects high-risk destructive database operations (DROP, TRUNCATE, or UPDATE) on sensitive tables executed within six hours of a large outbound data transfer from the same host, a pattern indicative of anti-forensic database wiping following data exfiltration.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to inhibit system recovery by deleting shadow copies, backup catalogs, or disabling automatic recovery features. This behavior is commonly observed in ransomware attacks.
Detects a sequence of suspicious activities on a Windows host aimed at inhibiting system recovery, such as deleting shadow copies, modifying boot recovery configurations, deleting backup catalogs, or stopping security and backup-related services. This rule aggregates distinct categories of these actions by DeviceId and Account to identify potential malicious intent characteristic of ransomware or data destructive attacks.
Detects a sequence of suspicious activities on a Windows host aimed at inhibiting system recovery, such as deleting shadow copies, modifying boot recovery configurations, deleting backup catalogs, or stopping security and backup-related services. This rule aggregates distinct categories of these actions by DeviceId and Account to identify potential malicious intent characteristic of ransomware or data destructive attacks.
Detects a sequence of suspicious activities on a Windows host aimed at inhibiting system recovery, such as deleting shadow copies, modifying boot recovery configurations, deleting backup catalogs, or stopping security and backup-related services. This rule aggregates distinct categories of these actions by DeviceId and Account to identify potential malicious intent characteristic of ransomware or data destructive attacks.
Detects network traffic associated with the WallStealer malware, including the download of malicious payloads from a known C2 server, communication with a cryptominer C2, and the use of Steam Community profiles as dead-drop resolvers for C2 instructions.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, clear backup catalogs, or disable system recovery features, which is a common behavior of ransomware before encrypting files.
Detects attempts by malicious software to inhibit system recovery by deleting Volume Shadow Copies. The rule monitors for the execution of vssadmin.exe with deletion flags or wmic.exe with shadowcopy deletion commands combined with non-interactive flags, which are common indicators of ransomware preparation.
Detects the execution of Nova ransomware (formerly RALord) by monitoring for its specific modular command-line interface arguments, which include file encryption commands, ransom note deployment, and specific ransom note filenames. The rule monitors process creation events for strings like 'encrypt-all', 'encrypt-path', 'readme-add', '--workers', and the presence of the 'README_NOVA.me' ransom note or unique file extensions associated with its encryption activity.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
Detects anomalous, large-scale provisioning of GPU-intensive cloud instances (such as p3, p4, g4dn, g5, and trn1 families) in AWS. This activity is indicative of cloud cryptojacking campaigns where adversaries hijack resources to rapidly spin up compute clusters for cryptomining, potentially incurring significant financial damage within a short period.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects unauthorized attempts to delete CloudTrail log files or destroy the underlying storage bucket used for logs. This activity is a form of anti-forensics intended to remove evidence of malicious activity within the cloud control plane. The detection excludes legitimate automated S3 lifecycle management events.
Detects the launch of compute-optimized or GPU-accelerated EC2 instances via the RunInstances API. This behavior is a common indicator of unauthorized resource hijacking, such as cryptomining, where attackers leverage compromised credentials to deploy resource-intensive workloads in regions that have not been historically used by the organization.
Detects rapid, large-scale deployment of high-vCPU/GPU compute instances, potentially indicating resource hijacking for cryptomining. The rule correlates high-compute instance launches with preceding AWS service quota increases, identifying potential malicious activity within an AWS environment.
Detects potential ransomware activity in AWS by identifying high volumes of S3 object encryption (using SSE-C or KMS) followed by the disabling or scheduled deletion of the associated KMS key material. This behavior aims to render data inaccessible to legitimate users while ensuring recovery is inhibited by destroying the cryptographic keys required for decryption.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Page 11 of 149