Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects the correlation of pass-the-hash execution tooling (such as Invoke-TheHash, Invoke-SMBExec, or Invoke-WMIExec) followed by the execution of the GodPotato privilege escalation exploit on the same device within a 24-hour timeframe.
Detects the execution or installation of known Lindnor backdoor binaries (such as healthcontroller64.exe, svchelper.exe, powerhost.exe, eventwatcher.exe, volumeproxy.exe) running as a service or with a service image path set within masqueraded folders like Chrome, Unpacker, or VMware.
Detects potential malicious software installation via two branches: Branch A identifies MSI files downloaded from suspicious URLs or with meeting/update lures (e.g., Zoom, Google Meet) followed by msiexec installation within one hour. Branch B detects msiexec command lines referencing RMM tools (ScreenConnect, LogMeIn, GoToResolve) combined with paths like Downloads, Temp, or AppData.
Detects PowerShell and msiexec activity referencing AgtaBackupAgent.msi where the parent process or initiator is associated with known Remote Monitoring and Management (RMM) tools such as LogMeIn Resolve, ConnectWise ScreenConnect, Ops RMM, or TraceRMM.
Detects the installation of a Google Meet-named MSI package via msiexec.exe from user-writable paths or non-Google URLs, correlated with the creation of a GoogleMeet.exe binary in the Google Meet Agent directory.
Detects a sequence where a build or minify tool (such as node, npm, esbuild, webpack) runs, followed shortly by a Node.js process modifying built JavaScript or HTML assets on the same device, which can indicate supply chain tampering or malicious code injection into application build outputs.
Detects a sequence where a build or minify tool (such as node, npm, esbuild, webpack) runs, followed shortly by a Node.js process modifying built JavaScript or HTML assets on the same device, which can indicate supply chain tampering or malicious code injection into application build outputs.
Detects execution of the SpikeStrip CLI via Node.js with dynamic provider configurations for OpenAI or Anthropic, correlated with outbound network connections to their respective public APIs from the same node process.
Detects potential credential spraying or brute force activity against Microsoft Entra ID (Azure AD) followed by a successful sign-in from the same IP address, subsequently leading to Azure Resource Manager (ARM) administrative actions performed by the same identity.
Detects the insertion of a USB mass storage device (mounted drive) followed closely within a 2-hour window by bulk file creation or modification activities (50 or more files) on that same removable drive letter. This behavior can indicate data staging and exfiltration using removable media.
Detects the execution of Quick Assist or Remote Desktop (mstsc.exe) followed within a 2-hour window by administrative/remote support or exfiltration tooling such as AnyDesk, Bomgar, Zoho, SuperOps, WinSCP, or rclone on the same device.
Detects the curl followed by a silent msiexec installation sequence, often used to deploy RMM agents or other payloads. It checks either a single command-line chain or a multi-step sequence within a 10-minute window.
Detects the execution of known portable utilities (WinSCP or Rclone) from user-writable directories (such as AppData, Temp, or Downloads) making outbound connections on port 22 and performing file transfer operations, suggesting potential data exfiltration.
Detects a sequence where a domain user account is created (via net.exe or New-ADUser) and the same account is subsequently added to privileged groups such as Domain Admins or Enterprise Admins within one hour.
Detects browser processes accessing a chatgpt.com/share/ link followed shortly thereafter by connections to multiple distinct external hosts, potentially indicating exfiltration or unauthorized interaction following an AI chat reference.
Flags endpoints associated with anonymous file-drop sites, paste services and chat platforms commonly abused for exfiltration and C2. Domains are matched with term-based has_any, which avoids the substring false positives of contains (e.g. t.me matching client.messaging.adobe, or file.io matching sharefile.io). Sanctioned services (Dropbox, Google Drive, OneDrive/SharePoint, Box) are intentionally left out to keep volume manageable; an optional block is included.
Detects rclone-style copy operations transferring data from a UNC share to an SFTP remote. It identifies malicious use by inspecting specific argument sets and handles renamed binaries (such as SearchApp.exe) masquerading as rclone.
Detects a portable runtime launched from a KB folder under AppDataRoaming that establishes network connections to multiple domain-infrastructure ports (such as ports 88, 445, 636 for AD CS or domain services enumeration), indicative of potential internal reconnaissance or abuse.
Archiving then sending data out within a short window is a hallmark of exfiltration. Implemented with correlate() over three event sets: archive process → transfer-tool process → that same process's public connection, all on one aid within 2 hours.
Detects the LLMjacking kill chain in GCP Vertex AI by correlating model enumeration, probing, and execution phases from a single identity.
Detects potential post-exploitation activity on Linux endpoints where a web/PHP-FPM process spawns a shell executing suspicious commands or deploying a webshell, followed closely by a curl or wget command interacting with the local loopback API.
Page 12 of 2907