Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
Detects the use of the sc.exe utility to disable critical system, security, and database services, a technique commonly associated with Everest ransomware to prevent service restart during encryption activities.
Detects Direct Send spearphishing impersonating internal roles (IT/Finance/Procurement) with business-themed lures targeting leadership/finance titles. Rewritten: removed a non-functional sender/recipient substring check and a broken EmailPostDeliveryEvents join that made the rule rarely fire; anchored detection to the actual Direct Send signature (null envelope + domain match) and a direct IdentityInfo join; standardized auth-failure parsing to match the other rules in this set.
Detects the modification of a Windows Registry Run key using reg.exe to schedule a forced system shutdown. This pattern is often associated with wipers or disruptive malware attempting to ensure system unavailability upon reboot or login.
Detects mass deletion of files related to backups, archives, or disaster recovery across multiple distinct devices within a short timeframe. This behavior is indicative of an adversary attempting to destroy backup infrastructure to prevent system recovery following a disruptive event such as ransomware deployment.
Detects the deletion of Volume Shadow Copies using native Windows utilities like WMIC or PowerShell cmdlets (Get-WmiObject, Get-CimInstance) targeting Win32_ShadowCopy. This behavior is a common indicator of ransomware preparation to inhibit system recovery prior to encryption, as observed in attacks involving the Akira ransomware.
This rule detects the presence of XMRig cryptocurrency mining binaries, including those associated with the MayaBot campaign, by inspecting file contents for characteristic strings, configuration parameters, and executable signatures.
Detects high CPU utilization (exceeding 80%) on VMware ESXi hosts during non-business hours (between 22:00 and 06:00). Such activity may indicate unauthorized resource hijacking, such as cryptocurrency mining, or performance degradation due to unexpected processes.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
Detects potential indirect prompt injection attacks against Microsoft Copilot where a 'summarize' action targeting a webpage is immediately followed by suspicious assistant behavior changes such as memory updates, suggesting the webpage content contained malicious instructions.
Detects a high volume of file rename events initiated by a single process on a device within a short time window (5 minutes). This behavior is often indicative of ransomware activity, where files are renamed as part of the encryption or extortion process.
Detects instances where Microsoft Copilot memory content (identified by hash) remains identical before and after a significant account security event, such as a password reset or session revocation. This behavior suggests that an adversary may have injected malicious or persistent data into the user's Copilot memory, which survives standard account remediation actions.
This rule detects a significant spike in usage for Azure Cognitive Services, specifically for operations like Chat Completions or Image Generation. By comparing the request count per caller to their historical average (hourly), the rule identifies potential abuse, service disruption, or unauthorized resource usage.
Detects Microsoft Copilot assistant responses that explicitly claim a documented CVE is safe or poses no risk. This behavior is consistent with potential memory-driven prompt manipulation or disinformation, where an attacker has poisoned the assistant's memory to downplay known security vulnerabilities.
Detects Cisco network devices experiencing unexpected reloads, crashes, or watchdog resets that are correlated with prior incoming WebVPN, AnyConnect, or SSL VPN HTTP requests. The rule also identifies multiple device reloads occurring within a short 15-minute window, which may indicate a distributed or repeated exploitation attempt against the SSL VPN infrastructure.
Detects Mach-O binaries embedding XMRig/Monero mining strings together with stratum mining protocol URIs and typical miner CLI flags, consistent with Monero miners dropped and executed as root following macOS Screen Sharing compromise.
Detects the execution of the temp_auto_push.bat tool, associated with the threat actor Void Dokkaebi, used to perform malicious commit amendments and code injection in source code repositories. The tool achieves this by manipulating the system clock to timestomp commit metadata, amending commits using 'git commit --amend --no-verify' to bypass security controls, and force-pushing the compromised history.
Detects the execution of various command-line tools (sc, net, powershell, wmic, taskkill, systemctl, launchctl) used to stop or disable system services. This behavior is often associated with adversaries attempting to stop security services, backup agents, or other critical infrastructure for impact, defense evasion, or prior to data destruction.
Detects execution of Monero mining indicators by a root-privileged process descended from screensharingd or its file-copy helpers, within 30 minutes of a Screen Sharing session on the host.
Detects devices exhibiting sustained high CPU or memory utilization (>= 90%) for a duration of at least 30 minutes, which may indicate resource exhaustion, performance degradation, or potentially malicious activity such as cryptocurrency mining, denial-of-service, or other unauthorized resource-intensive processes.
Page 35 of 149