Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects Salat Stealer dropping and executing copies of Lightshot.exe in trusted directories such as Windows NT, Edge, and Chrome application paths, as well as process spawn chains involving masqueraded Lightshot executables.
This rule aggregates software inventory, vulnerability assessments, network connection events, and exposure graph data to prioritize patching and identify internet-facing devices running PHP with known vulnerabilities or active web listeners.
Detects rundll32.exe creating a named pipe and subsequently establishing an SMB (port 445) connection to a private IP address within a 10-minute window, indicative of potential lateral movement or internal reconnaissance.
Detects a sequence where PowerShell disables security or monitoring preferences (defense evasion / sensor blinding) followed closely by injecting code or performing process hollowing into a Windows process from the same PowerShell process.
Correlates an IDE or extension host process querying api.ipify.org with a subsequent git command configuring the global user email on the same device within a 5-minute window. This behavior can be indicative of malicious setup or automated post-compromise activity.
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Detects disabling Windows Defender Exploit Guard Network Protection
Detects process command lines referencing browser credential
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
Detects WinRAR or 7-Zip extracting an archive with a hard-coded password supplied via command line from a cmd.exe batch parent, using switch patterns associated with the RareWolf AnyDesk dropper.
Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.
Detects Windows command line obfuscation where 'for' loops use the 'where' or 'dir /b' commands with wildcards to resolve and execute system binaries (LOLBins). This bypasses static string detection for common tools like certutil.exe or powershell.exe.
Detects execution of the builtin del/erase commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
This rule detects the execution of 'hh.exe' (Microsoft HTML Help Executable) specifically when it is used to open '.chm' (Compiled HTML Help) files. Adversaries often abuse 'hh.exe' to execute malicious code embedded within CHM files as a defense evasion technique, leveraging a legitimate system binary to proxy execution.
Detects when a process spawned by Microsoft Office or a web browser executes a child process.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
(Part 1 of a Correlation) Detects the creation of a potentially executable or script file by a browser or Microsoft Office application.
This rule is intended to be used in a correlation with a subsequent process execution.
This rule is intended to be used in a correlation with a subsequent process execution.
Detects .NET executables created in the Windows temp staging
directory C:\windows\temp\s\, a known Agrius wiper deployment location.
directory C:\windows\temp\s\, a known Agrius wiper deployment location.
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection
The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, such as file hashes, unusual command-line arguments, or known malicious behaviors associated with this tool.
The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, such as file hashes, unusual command-line arguments, or known malicious behaviors associated with this tool.
Detects the execution of shell interpreters (such as cmd, powershell, bash, osascript) as child processes of the Obsidian note-taking application. This behavior was observed in the REF6598 campaign where threat actors abused the "Shell Commands" community plugin to deliver the PHANTOMPULSE RAT. It also detects specific command-line indicators associated with the campaign.
Detects the execution of curl.exe to download an executable payload directly into the C:\ProgramData\ directory.
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
Page 10 of 1907