Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,222
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects repeated attempts to delete Volume Shadow Copies using WMIC. This is a common technique used by ransomware and other malware to prevent system recovery and inhibit forensic investigations. The rule filters out known backup agents and service accounts and identifies patterns where multiple distinct deletions occur within a 5-minute window.
Detects repeated attempts to delete Volume Shadow Copies using WMIC. This is a common technique used by ransomware and other malware to prevent system recovery and inhibit forensic investigations. The rule filters out known backup agents and service accounts and identifies patterns where multiple distinct deletions occur within a 5-minute window.
Detects unauthorized remote write operations (via SMB, Named Pipes, or TCP) to the Windows Certificate Services CertLog directory (C:\Windows\System32\CertLog\). This directory contains sensitive CA database, transaction logs, and checkpoint files. Any modification by a process other than the legitimate certsvc.exe is indicative of potential CA database tampering, malicious log manipulation, or anti-forensics activity.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
This rule detects a high volume of TCP synchronization (SYN) packets from external sources directed at a Cisco IOS XR network device. This behavioral pattern is indicative of a resource exhaustion denial-of-service (DoS) attack, potentially attempting to exploit vulnerabilities such as CVE-2026-20274 by flooding the control plane.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects attempts to inhibit system recovery by deleting volume shadow copies or modifying backup/boot recovery configurations. The rule monitors for the execution of vssadmin, wmic, wbadmin, and bcdedit with flags known to facilitate system recovery inhibition, often observed as a precursor to ransomware activity.
Detects forged Citibank payment confirmation/account statement PDFs used in Phantom Deal BPC fraud to falsely demonstrate wire transfer progress; requires combination of bank branding with fraud-specific SWIFT/routing/CTA artifacts
Detects forged NDA documents used in Phantom Deal M&A fraud campaign, requiring co-occurrence of impersonated advisory firm branding, secrecy-clause language restricting communication to personal channels, and M&A-fraud-specific wire/payment indicators rather than secrecy-clause phrasing alone
This rule monitors for inbound external emails where the sender requests private communication (e.g., 'private email' or 'personal address') in combination with keywords related to sensitive business topics like M&A, legal, or urgent financial transactions. This pattern is characteristic of Business Email Compromise (BEC) or social engineering attempts designed to move sensitive conversations outside of monitored corporate channels.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects potential Business Email Compromise (BEC) related to 'Phantom Deal' fraud. The rule identifies email threads where a user receives an urgent request for proof of payment (MT103/UETR) within 72 hours of an email discussion involving both wire transfer/payment keywords and M&A/deal context.
Detects inbound emails containing keywords associated with known ransomware extortion tactics (e.g., mention of specific ransomware names, data leaks, and payment demands). The rule filters for inbound traffic to identify external threats while excluding potential internal-generated traffic.
The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option.
This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred.
If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host.
Immediate investigation and response are crucial to mitigate potential damage.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option.
This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred.
If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host.
Immediate investigation and response are crucial to mitigate potential damage.
Page 33 of 149