Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
696
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
Detects suspicious renamed SysInternals DebugView execution
Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
This rule detects the Win32_Virus_Negt malware based on specific byte patterns found within the Portable Executable (PE) file. It checks for these patterns either at the entry point of the PE file or across multiple sections of the file, indicating the presence of the Negt virus body and its infector components.
Page 34 of 34