Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects anomalous database activity involving the creation of 'ZQ'-prefixed staging tables followed by a high-volume drop operation across multiple tables within a short timeframe. This behavior is indicative of data staging for potential exfiltration followed by an attempt to delete evidence or clear tracks.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, backup catalogs, or disable system recovery features. The rule further correlates this activity with preceding mass file activity to identify potential ransomware or destructive attack behavior.
Detects the use of bcdedit.exe to configure the boot environment to start Windows in 'safeboot' mode with networking enabled. Adversaries may use this to bypass security controls that only run in normal boot mode or to facilitate persistent access with minimal system interference.
Detects the use of bcdedit.exe to modify the boot configuration to enable Safe Mode with Networking. This is often used by adversaries to bypass security controls or to prepare a system for activities while in a state where many security products may not load or function.
Detects rapid, bulk process termination of critical system, security, database, and office applications using the Windows taskkill.exe utility. This behavior is characteristic of ransomware (such as DragonForce) attempting to release file locks prior to initiating encryption activities.
Detects high volumes of file creations, modifications, or renames ending with a specific encrypted file extension (.df_win) occurring across multiple network (SMB) shares from a single host within a short timeframe. This behavior is indicative of ransomware activity where a compromised host attempts to encrypt files on accessible remote storage.
Detects attempts to delete Volume Shadow Copies using native Windows administrative tools such as wmic.exe and vssadmin.exe. This activity is frequently associated with ransomware, as adversaries often delete local backups to prevent data recovery.
This rule detects processes that load the 'rstrtmgr.dll' library and subsequently perform mass process termination (3 or more distinct processes in under 2 minutes, excluding 'explorer.exe'). This behavior is commonly associated with ransomware, such as DragonForce, which uses the Windows Restart Manager API to identify and forcefully close applications that are locking files they intend to encrypt.
This rule detects the use of 'taskkill.exe' to terminate critical services, including security software (MsMpEng.exe), database processes (sql.exe, oracle.exe, sqlservr.exe), and common user applications (outlook.exe, onedrive.exe). This behavior is characteristic of the DragonForce ransomware, which disables protective services and applications before encryption to minimize interference and ensure successful file locking.
Detects high volumes of file rename operations within a short timeframe, which is a behavioral indicator often associated with the encryption process of ransomware such as CRPx0.
Detects the loading of rstrtmgr.dll by processes other than explorer.exe. Adversaries, particularly ransomware, utilize the Windows Restart Manager API (RmStartSession, RmRegisterResources, RmShutdown) to identify and forcibly terminate processes that hold file handles to files they intend to encrypt, thereby bypassing file-in-use locks.
Detects high-volume POST requests containing HEIF, HEIC, or AVIF image content types, indicative of automated fuzzing or exploitation attempts against an image-processing endpoint targeting CVE-2026-32882.
Detects high-volume POST requests containing HEIF, HEIC, or AVIF image content types, indicative of automated fuzzing or exploitation attempts against an image-processing endpoint targeting CVE-2026-32882.
Detects high-volume POST requests containing HEIF, HEIC, or AVIF image content types, indicative of automated fuzzing or exploitation attempts against an image-processing endpoint targeting CVE-2026-32882.
Detects the modification of a GitHub Actions release workflow that removes manual approval/gate requirements and introduces a push-to-main trigger, followed closely by an automated npm publish event. This behavior suggests an attempt to establish an unattended supply chain release path.
Detects instances of a force push to a GitHub repository where the commit author and committer names do not match, potentially indicating identity spoofing or tampering within the repository's history.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
Detects a specifically malformed IPv6 Routing Header (type 0) with a 'segments_left' value of 255 preceding an Authentication Header (AH). This signature targets an exploit pattern known as 'DirtyAH6', which aims to trigger a remote kernel crash or potential remote code execution on vulnerable systems by manipulating IPv6 header processing.
Detects a specifically malformed IPv6 Routing Header (type 0) with a 'segments_left' value of 255 preceding an Authentication Header (AH). This signature targets an exploit pattern known as 'DirtyAH6', which aims to trigger a remote kernel crash or potential remote code execution on vulnerable systems by manipulating IPv6 header processing.
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
This rule detects modifications to the Windows hosts file by unauthorized processes. The hosts file is often targeted by adversaries to redirect network traffic, intercept communications, or prevent access to security-related websites.
Page 21 of 149