Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects cmd.exe invoked with '/c move' relocating a downloaded payload into a timestamp-named appdata folder, consistent with a Lampion scheduled-task move stage.
Detects when rundll32 runs with the "jangadeiro" argument from the AppData directory.
The rule attempts to locate the use of the DLL from the lampion RAT to intercept browser credential operations, this is one of credentials theft techniques by Lampion.
Detects a DLL loaded into msiexec.exe that exports a function named RUN and exhibits Tokio async-runtime initialization behavior, reading the TOKIO_WORKER_THREADS environment variable and/or calling GetSystemInfo followed by multiple CreateThread calls to size its worker thread pool. Matches msaRAT behavior where the malicious Rust/Tokio DLL is loaded via an MSI custom action running under msiexec.exe.
Detects msiexec.exe-associated registry activity involving Chrome or Edge installation paths, matching msaRAT browser discovery before it launches a headless CDP session.
Detects Windows Installer executing an MSI package from ProgramData, matching the msaRAT delivery chain in which update_ms.msi is downloaded to that directory and then executed.
Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.
Detects lib.dll being loaded by msiexec.exe, an unusual image-load relationship that matches the embedded MSI custom action used by msaRAT.
This rule attempts to detect the command flags from the msaRAT.
Detects msiexec.exe launching Chrome or Edge in headless mode with a remote debugging port and a custom user-data directory, matching the browser-hijacking stage used by msaRAT.
This rule detects the Download of the stager for the msaRAT directly from the IP marked as IOC
The rule attempts to detect the use of powershell to exec "officoprotocolo", which was part of the PhatomEnigma campaign
Detects creation or overwrite of the Windows shortcut name pattern observed in the Guildma Startup-folder persistence mechanism when the creator is a script interpreter, LOLBin, or process running from a user-writable location. The Cortex XDR Sigma backend maps TargetFilename to action_file_name and cannot represent the Startup directory path; use the companion native XQL rule for path-based detection.
Detects the hidden PowerShell command used by the observed Guildma Startup shortcut to launch a renamed AutoIt interpreter and a compiled script disguised as a LOG file from a user-writable public cache directory.
Detects an AutoIt interpreter executing outside the usual AutoIt installation directories. Identification uses either the normal executable name or the AutoIt code-signing publisher, allowing Cortex XDR to identify many renamed copies without relying on the unsupported OriginalFileName Sigma field.
Detects processes executing from user-writable locations connecting to TCP 8443, a behavior reported for the BraZetsu WebSocket backdoor.
Detects the PowerShell download-and-execute method used by the Exvicy ClickFix example without relying on its domain.
Detects PowerShell launching the exact remote script URL shown in the Exvicy ClickFix report.
Detects MsMpEng.exe writing executables or libraries into System32 or SysWOW64 directories, which can be indicative of junction-redirected remediation abuse.
Detects attempts to discover domain controllers using various fallback methods, including nltest, PowerShell commands, and environment variable queries. These techniques are often employed by attackers to map the network and identify critical infrastructure.
Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
Page 12 of 1907