Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
This rule detects unsuccessful attempts by human users to delete objects from Google Cloud Storage buckets that are protected by bucket-level retention policies. By filtering out service accounts, the rule specifically focuses on non-automated, human-initiated actions that violate data retention requirements.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
This hunting query identifies GitHub activites where there are a large number of deletions that may be a sign of compromise.
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects initiated network connections to crypto mining pools
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects the use of PowerShell to invoke 'Confirm-SecureBootUEFI' or 'Clear-SecureBootKeys' cmdlets. These commands are utilized by the TOKYOCORE wiper malware to erase the UEFI Secure Boot key database, effectively preventing the system from booting a signed operating system as part of a destructive attack chain.
Detects TOKYOCORE ransomware artifacts referencing the fsociety.exe binary being dropped to Downloads and copied to System32, alongside the WindowsUpdate.exe persistence copy
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Possible DDoS botnet outbound flood burst from infected host
This rule detects unauthorized access or modifications to hardware watchdog device files (/dev/watchdog, /dev/watchdog0, /dev/misc/watchdog, /dev/FTWDT101_watchdog) on Linux systems. Adversaries may manipulate these files to disable the hardware watchdog's automatic reboot functionality, potentially to maintain persistence or to ensure system stability while performing malicious actions without the risk of an unexpected forced reboot.
Detects malicious usage of bcdedit.exe to weaken system boot security. The rule flags commands that disable Windows Recovery (WinRE), boot integrity checks, driver signature enforcement, or force legacy boot policies, which are often used by ransomware like TOKYOCORE to prevent system recovery and hinder defensive remediation.
Detects the use of bcdedit.exe to modify boot configuration data in a way that disables system recovery features, ignores boot failures, or bypasses integrity checks. This activity is often associated with ransomware or malicious persistence mechanisms aimed at preventing system recovery or loading unsigned drivers.
Detects the use of vssadmin.exe to delete all volume shadow copies with the '/all' and '/quiet' flags. This technique is commonly employed by ransomware, including TOKYOCORE, to prevent system recovery by destroying backup snapshots prior to file encryption.
This rule detects attempts to sabotage or brick Linux systems by monitoring for modifications or overwrites of critical system binaries responsible for reboot, shutdown, and power management, including 'reboot', 'shutdown', 'halt', 'poweroff', 'systemctl', and 'telinit'. It specifically identifies activity associated with the 'ELFOOD' header-corruption marker, a technique linked to the Tengu malware strain which prevents legitimate system reboots to maintain persistence and impede remediation efforts.
Page 38 of 149