Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Detects malicious activity involving the HTS software update mechanism, where the legitimate updater or patch processes are leveraged to download and execute the HTSPnew.exe ransomware payload.
Detects the execution of the KRSID ransomware binary, which is written in Rust. The rule identifies the malware based on its unique file extensions, ransom note filenames, specific command-line arguments, log file indicators, and compiled code characteristics.
This rule detects potentially suspicious activity within a Git repository environment, specifically monitoring for code pushes, administrative changes (such as added collaborators, permission changes, or ownership transfers), and force push operations. It identifies high-impact repository modifications that could indicate unauthorized access, persistence, or attempts to disrupt repository integrity.
Detects the deletion of Volume Shadow Copies using the Windows Management Instrumentation Command-line (WMIC) utility. This behavior is commonly observed in ransomware attacks, including those attributed to DragonForce and CRPx0, as a method to inhibit system recovery prior to file encryption.
Detects malicious tampering with GitHub Actions workflows by monitoring for two specific patterns within an hour: the addition of automatic push triggers for the main branch alongside the removal of manual approval gates, or rapid sequential commits that rewrite workflows to facilitate an unattended publish of a package. This rule also integrates with npm registry publish events to identify potential malicious distribution of compromised packages like @dforge-core/dforge-mcp.
Detects instances where a repository's GitHub CI/CD workflow, git configuration, or repository settings are modified, followed shortly thereafter by an npm package publish event. This behavior is indicative of a supply chain compromise where an adversary modifies workflow files to auto-publish malicious versions of a package.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
Detects instances where an AI agent (e.g., Semantic Kernel) launches command-line tools commonly used to perform bulk data destruction or system wiping, such as file deletion commands, volume shadow copy removal, or disk formatting. This rule flags suspicious orchestration by AI agents that may be acting outside of expected parameters.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects the creation of a mutex with the 'Global\evolution' prefix, which is a known indicator of the XMRig cryptocurrency miner execution.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects unauthorized modification of system cron files by the redis-server process, indicative of rogue redis replication exploitation, followed by the execution of a cron job associated with the XMRig cryptocurrency miner.
Detects the mass termination of security, backup, database, and virtualization services and processes. The rule monitors for the use of 'taskkill', 'sc', and 'net stop' commands, targeting a list of processes and services often associated with pre-encryption cleanup activities by ransomware actors to neutralize security tools and data access controls.
Detects modifications to payroll direct deposit or payment election settings within Workday. This activity is a common indicator of payroll fraud or Business Email Compromise (BEC), where an attacker gains access to an employee's Workday account to redirect salary payments to an unauthorized bank account.
Detects high-volume deletion or recycling of files within OneDrive or SharePoint for a specific user, which may indicate malicious activity such as data destruction, ransomware, or unauthorized data exfiltration staging.
Detects inbound email messages containing keywords and phrases consistent with extortion attempts, specifically referencing stolen data, unauthorized access, and demands for cryptocurrency payment.
Detects suspicious activity on VMware ESXi hosts involving the termination or unregistration of virtual machines via 'esxcli' or 'vim-cmd', correlated with high volumes of file modification or creation events (.vmdk or .vmx files) within a short window. This pattern often indicates attempts to disrupt virtual machines or inhibit system recovery by adversaries.
This rule detects mass file modification, creation, or renaming activity involving files with the '.krsid' extension. The threshold is set to monitor for more than 20 occurrences, which is indicative of potential ransomware encryption activity, while explicitly excluding common system, temporary, and development paths, and filtering out processes explicitly performing shadow copy deletion.
Page 16 of 149