Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects the presence of known Chaos ransomware samples by matching their SHA256 hashes against process execution events and file events. If a process with a matching hash is executed or a file with a matching hash is observed, an alert will be triggered.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
This rule detects potential ransomware activity by identifying a high volume of file encryption events. It looks for files being renamed or created with common ransomware-related extensions such as '.locked', '.crypt', '.encrypted', '.enc', or a generic pattern of a 6 or more character alphanumeric extension. The rule then counts these events within one-hour bins and alerts if more than 20 such files are detected in a single folder path.
This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.
Detects RuntimeHost.exe launched from an unusual cache directory frequently associated with malware staging and cryptomining activity.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
This rule detects potential ransomware activity by monitoring for a high volume of file creation or renaming events where the new file names end with common ransomware extensions such as '.encrypted', '.locked', or '.crypted'. It aggregates these events over 5-minute intervals and triggers if 50 or more such files are observed on a single device.
This rule detects suspicious file renaming activities indicative of ransomware. It specifically looks for files that previously had common document extensions (.doc, .xls, .ppt) being renamed to extensions commonly associated with encryption by ransomware (.encrypted, .locked, .crypted, .ecc). The rule triggers if 20 or more such renames occur within a 5-minute window on a single device.
This rule detects suspicious file activity indicative of ransomware by monitoring for a high volume of file creations or renames where the filenames contain common ransomware-related extensions such as '.encrypted', '.locked', or '.ransom'. It aggregates these events over a one-hour period per device and triggers if 20 or more such events occur.
Detects instances where a significant number of files (50 or more) are deleted on a device within a 5-minute window. This can indicate malicious activity such as ransomware, data destruction, or an attacker attempting to cover their tracks.
This rule detects devices making a high volume of outbound network connections (more than 1000 connections within a one-minute window) to a single remote IP address. This behavior could indicate a network denial-of-service (DoS) attack originating from the device, or potentially other forms of high-volume network activity such as data exfiltration or scanning.
Detects instances where the 'killall' command is used to forcefully terminate Google Chrome processes. This activity can be indicative of malware attempting to disrupt browser activity, potentially to prevent detection, interfere with user sessions, or facilitate other malicious actions. Specifically, this behavior has been associated with the FlutterShell backdoor.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
This rule detects when a device wipe or delete operation is performed via Microsoft Intune. It specifically looks for 'wipe ManagedDevice' or 'Delete ManagedDevice' operations in Intune audit logs within the last 24 hours. The rule is designed to be correlated with other alerts by filtering on a specific ActorUPN, indicating a potential malicious mass device wipe attack.
This rule detects attempts to delete shadow copies or system backups using built-in Windows utilities like vssadmin.exe, wbadmin.exe, and diskshadow.exe. These actions are often associated with ransomware behavior to prevent system recovery.
KQL Query from file: Email Bombing and Teams Impersonation Detection
This rule detects a high volume of Azure resource deletions by a single user within a short timeframe (30 minutes). This behavior is indicative of a destructive attack or wiper activity, where an adversary attempts to delete critical cloud infrastructure to disrupt operations or cause data loss. The rule specifically looks for 'delete' operations that were successful and counts them per caller and IP address, triggering an alert if the count exceeds a defined threshold.
This rule detects potential ransomware activity by identifying a high volume of file encryption events. It looks for files being renamed or created with common ransomware-related extensions such as '.locked', '.crypt', '.encrypted', '.enc', or a generic pattern of a 6 or more character alphanumeric extension. The rule then counts these events within one-hour bins and alerts if more than 20 such files are detected in a single folder path.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
Page 81 of 149