Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,061 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,759
3,853
3,760
3,714
Platforms
40,061
7,331
6,542
3,907
3,664
Products / Services
10,439
9,679
6,724
1,888
1,879
MITRE Techniques
13,740
13,119
8,066
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects execution of various reconnaissance commands commonly used by Remote Access Trojans (RATs) to profile a target host. This includes querying security product status (AV/Defender), enumerating domain controllers, network adapters, port scanning, and gathering system hardware and software inventory.
This rule detects the execution of 'netstat.exe' when initiated by a Python process (python.exe, python3.exe, or pythonw.exe) where the executable is located in non-standard, likely project-specific or virtual environment directories (e.g., 'Scripts', 'bin', 'venv', 'site-packages'). This pattern is often used to execute system binaries from unconventional locations to evade detection or as part of a post-exploitation activity where a script or package includes a malicious or hijacked version of a legitimate system tool.
Detects various indicators of compromise (IOCs) including known malicious file hashes, suspicious file names commonly associated with staging or initialization in web directories, and network communication to known malicious domains or URLs. It also monitors process execution command lines for references to these IOCs, excluding common browser processes.
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
Detects suspicious command execution patterns (such as PowerShell encoded commands, IEX, or cmd.exe) being stored or accessed within the Windows Registry 'TypedPaths' key, which is used by Windows Explorer to track recently accessed paths. Adversaries may attempt to use this location to execute payloads via user-triggered interactions.
Detects a suspicious command-line chain where 'cmdkey' is used to add credentials, followed by the execution of 'regsvr32' targeting a DLL file hosted on a remote UNC path. This pattern is commonly associated with ClickFix or FileFix techniques where an adversary attempts to force authentication and execute malicious code via proxy execution.
Detects the creation of a scheduled task using either the 'schtasks.exe' utility or PowerShell's 'Register-ScheduledTask' cmdlet where the task configuration is pulled from an XML file located on a remote network share or HTTP/HTTPS resource. This pattern is commonly used by adversaries to facilitate persistence or lateral movement by remotely deploying tasks.
Detects suspicious command-line fragments being written to the Windows RunMRU registry key, which is used by the Explorer 'Run' dialog to store history. Adversaries may abuse this by injecting malicious command lines that are then executed when a user attempts to run a program.
Detects instances where Windows Explorer launches command interpreters (cmd.exe, powershell.exe, wscript.exe, or mshta.exe) with suspicious leading whitespace in the command-line arguments. This behavior is often associated with obfuscation techniques intended to bypass command-line monitoring or security filters.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the task configuration is fetched from a remote XML file (HTTP/HTTPS URL). This pattern is often used by adversaries to download and execute malicious payloads via task scheduling, bypassing local file restrictions.
Detects a suspicious process chain where a web browser spawns the Windows Explorer process (typically representing a file dialog) which then immediately spawns a command interpreter (cmd.exe, powershell.exe, or mshta.exe). This pattern is consistent with ClickFix or similar attacks where a user is tricked into pasting a malicious command into a browser-triggered file selection window address bar.
FileFix loader chains abuse trusted code-hosting platforms like Bitbucket/GitHub to host staged payload components, exploiting domain trust to evade network detection.
Detects attempts to bypass Vite development server file access restrictions by appending query parameters such as ?raw, ?import&raw, or ?import&url&inline to request paths for sensitive files like .env, cloud credentials, and terraform state files.
This rule monitors for indicators of compromise (IOCs) associated with known malware and C2 infrastructure, including specific IP:port combinations, malicious domains, URLs for file downloads, and SHA256 hashes of known malware. The rule correlates data across device network events, file events, and process execution events to identify potential infections or communication with malicious infrastructure.
This rule detects two suspicious behaviors: 1) Execution of common system binaries (e.g., rundll32.exe, powershell.exe) from a directory pattern resembling a temporary folder or droppers, and 2) Network connections initiated by the 'attrib.exe' binary, which is atypical for this utility and may indicate malicious activity or staging.
Detects potential vishing activity associated with the Sauron Loader threat. The rule identifies a pattern of a mailbox receiving a high volume of inbound emails (spam or subscription bombs) within a short window, followed by the user launching remote assistance tools like Quick Assist or AnyDesk on the same endpoint, indicating an attacker-guided remote session.
Detects the modification of AI agent configuration files (e.g., mcp.json, config.json) followed shortly by the agent spawning a child process that matches typical Model Context Protocol (MCP) server execution patterns. This behavior may indicate an attacker has modified the configuration to inject malicious server commands or tools that the AI agent will execute upon next initialization, effectively achieving persistent code execution via the agent's legitimate functionality.
Detects the Exvicy 'ClickFix' campaign execution chain where explorer.exe spawns a PowerShell process utilizing download commands (e.g., Invoke-WebRequest, Invoke-RestMethod) to interact with known malicious domains or IP addresses, followed by the execution of installers (msiexec.exe) or tools (putty.exe) within a short timeframe.
This rule detects unscheduled modifications to federation, application, or service principal credentials, including ADFS token-signing certificates, in both Azure AD (via O365 management activity logs) and local Windows environments (via Security Event Logs). It filters these events against a known rotation schedule to highlight suspicious, non-routine changes that may indicate persistence establishment or identity provider tampering.
Detects anomalous behavior where a node.exe process establishes an outbound network connection, characteristic of a C2 registration or ping loop, followed shortly by the spawning of an interactive command shell (cmd.exe or powershell.exe) by the same node.exe process. This pattern is indicative of a RAT (Remote Access Trojan) shell handler execution.
Detects high or medium severity security alerts related to Kerberos Golden Ticket forgery, as identified by Microsoft Defender for Identity. This rule filters for specific alert names indicative of forged TGTs minted from the krbtgt account, excluding generic or informational ticket anomalies.
Page 107 of 1908