Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,065 detections
Filters
Last updated
All Time
Detection languages
15,361
13,598
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,115
9,760
3,854
3,760
3,714
Platforms
40,065
7,331
6,542
3,907
3,666
Products / Services
10,442
9,679
6,724
1,888
1,879
MITRE Techniques
13,740
13,120
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects potentially malicious in-memory module loading, such as Beacon Object File (BOF) execution, on hosts already identified as exhibiting suspicious behavior related to MLTBackdoor or sideloading activity. It monitors for memory allocation or protection changes (AllocateVirtualMemory, VirtualProtect, CreateRemoteThread) that result in executable memory (RWX or execute-only) without a corresponding file on disk, which is a common indicator of fileless code injection.
Detects the Microsoft Support Diagnostic Tool (msdt.exe) being launched by Office applications or web browsers using the ms-msdt protocol handler or PCWDiagnostic parameters, which is indicative of the Follina (CVE-2022-30190) vulnerability exploitation.
Detects instances where the Windows Script Host (wscript.exe) is used to launch node.exe with specific command-line arguments (e.g., executing index.js) or a specific binary name, which is indicative of malicious script-based execution chains often seen in RAT deployment.
Detects the execution of binaries that masquerade as legitimate Adobe-signed applications by running from non-standard locations, while simultaneously performing DLL side-loading by loading a malicious 'msvcp140.dll' from the same directory as the executable.
Detects suspicious PowerShell process executions initiated by Windows Explorer that include command-line arguments typically used for downloading and executing content from the internet. This pattern is commonly associated with fileless malware execution or malicious script droppers.
This rule detects potential ClickFix/InstallFix attacks where a user is socially engineered to copy and paste a malicious command from a website that mimics a legitimate developer tool installation (e.g., Claude Code, NotebookLM). The detection flags the use of common download-and-execute cmdlets (e.g., irm, iwr, iex) within common Windows shell interpreters while excluding known legitimate vendor install domains.
This rule detects potential ClickFix/InstallFix attacks where a user is socially engineered to copy and paste a malicious command from a website that mimics a legitimate developer tool installation (e.g., Claude Code, NotebookLM). The detection flags the use of common download-and-execute cmdlets (e.g., irm, iwr, iex) within common Windows shell interpreters while excluding known legitimate vendor install domains.
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
Detects the simultaneous activation of three or more distinct browser profiles on the same device within a one-hour window. This behavior is used as a proxy for browser session hijacking or 'browser sync' attacks, where an adversary bridges a compromised personal identity into a managed corporate browser environment.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects modifications to the 'PlugPlay' Windows service using 'sc.exe', specifically involving changes to the binary path (binpath) and subsequent service status changes (start/stop) within a short timeframe (30 minutes). This behavior is often associated with the persistence or hijacking of services to execute malicious files, specifically targeting Microsoft Office or Copilot-related process names.
Detects the deletion, truncation, or modification of critical PaperCut server logs and application files (server.log, pcxboot_l.txt, .bin files). This activity is associated with attempts to conceal exploitation of PaperCut vulnerabilities (e.g., CVE-2026-82078/81578) by clearing logs or tampering with binaries, typically executed by the PaperCut application processes themselves (pc-app.exe or Java runtime).
Detects the use of ntdsutil.exe with arguments indicative of Install From Media (IFM) backup creation, correlated with subsequent access to the ntds.dit file on the same device within a one-hour window. This behavior is commonly associated with attackers attempting to harvest the Active Directory database for offline credential cracking.
Detects the execution of PowerShell or PWSH with encoded command flags (-EncodedCommand, -enc, -e), which is a common technique used by adversaries to hide malicious scripts or payloads from inspection.
Detects the creation of scheduled tasks using schtasks.exe that involve suspicious arguments (such as encoded commands, execution from volatile directories like Temp/AppData, or run-once triggers) shortly after a file has been downloaded into a temporary or user-writable directory. This pattern is commonly indicative of an adversary establishing persistence for downloaded malware.
Detects modifications to Windows Registry Run/RunOnce keys or file creation events in the Startup folder by processes not identified as standard system installers or Windows Explorer, indicating potential persistence attempts.
Detects modifications to Windows Registry Run/RunOnce keys or file creation events in the Startup folder by processes not identified as standard system installers or Windows Explorer, indicating potential persistence attempts.
Detects anomalous Kerberos TGS-REQ activity (Event ID 4769) from a single user account targeting five or more distinct Service Principal Names (SPNs) using RC4 encryption (0x17). This pattern is consistent with Kerberoasting techniques used by offensive tools like Rubeus, where service tickets are requested for offline cracking to extract plaintext service account credentials.
Detects execution of rundll32.exe or regsvr32.exe with potentially malicious command-line arguments, including references to external URLs, protocol handlers like javascript:, or loading DLLs from user-writable directories (Temp, AppData, Downloads). This behavior is characteristic of Living-off-the-Land (LotL) techniques used to proxy execution and bypass application control or security monitoring.
Page 115 of 1908