Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects attempts to tamper with or destroy Windows Boot Configuration Data (BCD) using bcdedit.exe to weaken system security policies or registry-based deletion of the BCD store to inhibit system boot and recovery.
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
Detects attempts to inhibit system recovery by deleting volume shadow copies or modifying backup/boot recovery configurations. The rule monitors for the execution of vssadmin, wmic, wbadmin, and bcdedit with flags known to facilitate system recovery inhibition, often observed as a precursor to ransomware activity.
Detects attempts to inhibit system recovery by deleting volume shadow copies or modifying backup/boot recovery configurations. The rule monitors for the execution of vssadmin, wmic, wbadmin, and bcdedit with flags known to facilitate system recovery inhibition, often observed as a precursor to ransomware activity.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
Detects high volumes of file renaming activities involving files with the .df_win extension. This pattern is often indicative of ransomware-like behavior where mass renaming occurs as part of an encryption process, impacting multiple directories.
Detects anomalous, high-value wire transfers involving keywords related to advance-payment or M&A-related fraud (e.g., 'advance retainer'), directed towards beneficiaries in Hong Kong using previously unseen bank accounts. The rule effectively filters out known, approved beneficiary accounts to focus on potentially malicious transactions.
This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects modifications, creation, or renaming of the Windows hosts file located at 'C:\Windows\System32\drivers\etc\hosts'. Adversaries often modify this file to redirect network traffic, facilitate phishing, or prevent security tools from communicating with update or telemetry servers.
Detects instances where a high-value security or transaction-related notification email is received concurrently with a burst of non-essential bulk or subscription-based emails. This pattern is indicative of an email-bombing (inbox flooding) attack, often used to bury critical alerts and mask malicious activity such as unauthorized account access or fraudulent financial transactions.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
Detects DragonForce ransomware note (readme.txt) referencing known DragonForce Tor negotiation/blog onion addresses
This rule detects potentially malicious activity where multiple critical processes (such as database engines or email clients) are terminated in a short time frame, correlated with a high volume of file creation or modification events on the same device. This behavior is indicative of destructive activity, such as ransomware encrypting data stores or disabling defensive software.
This rule detects potentially malicious activity where multiple critical processes (such as database engines or email clients) are terminated in a short time frame, correlated with a high volume of file creation or modification events on the same device. This behavior is indicative of destructive activity, such as ransomware encrypting data stores or disabling defensive software.
Page 32 of 149