Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects a suspicious sequence of system utility executions (reagentc.exe, diskpart.exe, ipconfig.exe, and cipher.exe) originating from a single parent process within a 10-minute window. This behavior is indicative of ransomware attempting to inhibit system recovery and perform anti-forensic actions.
Detects Settra ransomware binaries for Windows by identifying specific file naming conventions ('_win64.exe'), ransom note filenames, encrypted file extensions, and target directory paths embedded within the binary.
Detects the creation of files with specific extensions (.locked, .locked_wip) or filenames (RESTORE_FILES.txt) commonly associated with ransomware operations and ransom notes.
Detects instances where sensitive Active Directory database files (NTDS.DIT) are accessed, correlated with the execution of common system administration utilities (ntdsutil, vssadmin, diskshadow, esentutl) known to be leveraged by adversaries to create volume shadow copies or extract data for offline credential harvesting.
Detects potential Qilin ransomware binaries following Cisco FMC-based intrusion by UAT-11988. Source intel provides only name-level attribution (no sample hash/byte IOC for the payload), so this is tightened to a valid PE, a plausible ransomware-payload size band, and >=2 occurrences of the family string -- a bare single 'Qilin' substring in an arbitrary PE (e.g. an unrelated app, build path, or AV/report string) is not sufficient to alert on alone.
This rule detects potential ransomware activity by correlating three distinct indicators: deletion of Volume Shadow Copies (using native Windows utilities), mass file modifications (>100 files in 15 minutes), and the creation or modification of files typically associated with ransom notes. The rule uses an inner join to ensure these events happen within a 30-minute window of each other on the same device.
This rule detects potential ransomware activity by correlating three distinct indicators: deletion of Volume Shadow Copies (using native Windows utilities), mass file modifications (>100 files in 15 minutes), and the creation or modification of files typically associated with ransom notes. The rule uses an inner join to ensure these events happen within a 30-minute window of each other on the same device.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
Detects high-value wire transfers (>= €600,000) directed to beneficiaries in Hong Kong that contain suspicious memo or description fields related to confidential acquisitions or professional service retainers, potentially indicating business email compromise (BEC) or fraudulent financial activity.
This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects anomalous TCP stream reassembly where overlapping segments contain different data. This technique is often used to bypass Network Intrusion Detection Systems (IDS) by presenting different data to the target system than what the IDS inspects.
Detects forged NDA documents used in Phantom Deal fake acquisition fraud, requiring corroborating secrecy-clause language and M&A-fraud-specific wire-transfer/payment phrasing alongside impersonated advisory brands
Detects high-frequency file creation, modification, or renaming activity involving files with the specific '.df_win' extension, likely indicative of mass encryption activity or automated ransomware behavior. The rule excludes known backup and security software processes to reduce noise.
Detects unauthorized attempts to disable or stop critical Windows Update services (wuauserv, UsoSvc, uhssvc, WaaSMedicSvc) via command line tools or service configuration changes. This behavior is indicative of defense evasion by malware such as Silver Fox/Gh0st RAT, aimed at preventing security updates or disabling security-related service monitoring.
Detects unauthorized write, modification, or rename operations performed on the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) by processes that are not typically authorized for such activity, such as standard system processes (svchost, services, etc.).
Detects unauthorized write, modification, or rename operations performed on the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) by processes that are not typically authorized for such activity, such as standard system processes (svchost, services, etc.).
This rule detects modifications to the Windows hosts file (C:\Windows\System32\drivers\etc\hosts). Adversaries often modify this file to redirect legitimate traffic to malicious IP addresses, a technique commonly used for command and control or phishing campaigns.
Detects unauthorized modifications to the Windows HOSTS file (C:\Windows\System32\drivers\etc\hosts). Adversaries frequently modify this file to perform DNS hijacking or domain redirection, steering users to malicious infrastructure or bypassing security controls. The rule filters out known legitimate system processes that typically interact with this file.
Detects modification of the Windows HOSTS file (C:\Windows\System32\drivers\etc\hosts), which is a common technique used by malware to redirect network traffic, block access to security updates, or facilitate command and control communication.
Page 27 of 149