Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,222
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects email communications from a recently-created account (within 60 days of account creation) requesting redirection of payroll or business payments to a personal bank account under a fabricated 'bank account under review' pretext, consistent with PurpleDelta payment-fraud tradecraft.
Detects anomalous, frequent, or repetitive device crash events (including BSODs) on a single device, which may indicate system instability, hardware failure, or an attempt to induce a Denial of Service (DoS) condition on the endpoint.
Detects the image load of VSS DLL by uncommon executables
Detects the image load of VSS DLL by uncommon executables
Windows Multiple User Account Deletions
Cortex XDR
Detects five or more distinct Windows user-account deletion events (Event ID 4726) performed by the same actor on the same host within a one-hour time window, which may indicate unauthorized account access removal or malicious impact activity.
Windows Multiple User Accounts Disabled
Cortex XDR
Detects five or more distinct Windows user-account disable events (Event ID 4725) performed by the same actor on the same host within a one-hour time bucket, which may indicate unauthorized account access removal.
Detects repeated screensharingd crash/restart cycles tightly time-correlated with file-copy helper activity, indicating CVE-2026-43777 DoS exploitation alongside its secondary file-copy abuse potential.
Detects the LockScreen component blocking user input and displaying a full-screen StopAndProtect ransom note referencing Telegram/BTC payment.
Detects coordinated activity where a PowerShell process executes multiple distinct administrative utilities (such as wevtutil, vssadmin, wbadmin, or bcdedit) to perform destructive actions like clearing event logs, deleting shadow copies, or disabling system recovery settings. This rule uses correlation to identify sequences of at least three distinct commands and utilities, reducing false positives associated with single administrative tasks.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
Detects bursts (3+ within 10 minutes) of screensharingd crash/respawn or anomalous child-process events consistent with the CVE-2026-43777 denial-of-service condition, excluding OS update/boot windows.
This rule identifies newly created cloud accounts (AWS or Google Cloud) that exhibit immediate and high-volume API activity within an hour of their creation. This pattern is indicative of resource hijacking, where attackers exploit promotional or startup cloud credits to perform unauthorized tasks, such as hosting proxied API services for resale.
Detects SilentEncryptor ransomware by correlating Encryptor.exe execution with a mass file-rename burst and creation of encrypted_files_V/encryption_log_V artefacts.
Detects anomalous, frequent, or repetitive device crash events (including BSODs) on a single device, which may indicate system instability, hardware failure, or an attempt to induce a Denial of Service (DoS) condition on the endpoint.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Windows High-Value Account Disabled
Cortex XDR
Detects Windows Security Event ID 4725 which signals that a user account has been disabled. This rule specifically correlates the event with a locally maintained inventory of high-value accounts, such as executive, privileged, or service accounts, to identify potentially disruptive or unauthorized account access removal.
This rule monitors Zscaler Internet Access logs for high volumes of session activity, specifically detecting when a user exceeds a burst threshold of new session creations or consistently operates near the maximum allowed concurrent session limit within a 10-minute window. This behavior may indicate account compromise, automated credential stuffing, or abuse of access policies.
Detects devices exhibiting sustained high CPU or memory utilization (>= 90%) for a duration of at least 30 minutes, which may indicate resource exhaustion, performance degradation, or potentially malicious activity such as cryptocurrency mining, denial-of-service, or other unauthorized resource-intensive processes.
This rule detects the file deletion activities on azure blob storage accounts
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
This rule detects the use of the Windows Boot Configuration Data Editor (bcdedit.exe) to modify system recovery settings. Specifically, it looks for attempts to disable recovery features or instruct the boot manager to ignore failures. Such modifications are common in ransomware and destructive attacks to prevent users from using Windows recovery tools to restore the system or access backups.
Page 36 of 149