Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.
Detects a sequence where a Codex agent process executes a shell or command interpreter, followed by logging or monitoring tampering activity on the same device within a 30-minute window.
Detects the execution of the AI prompt hook script 'project_context_hook.py' or the creation/modification of the associated investigation state files (scope.md, surface.md, notes.md) within the same folder.
Detects potential local privilege escalation (LPE) attempts leveraging the afd.sys vulnerability by correlating LPEClient or FudModule artifact creation, image loads, or process execution with subsequent afd.sys driver loading or exploit guard blocking events within a 60-minute window.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects DeElevate64.exe within the Stardock Smart DeElevation Tool directory loading I++u.dll, a known malicious loader dependency associated with patched DeElevator64.dll usage.
Detects the execution of known Remote Monitoring and Management (RMM) tools within a 30-minute window following Microsoft Teams network activity on the same device, which can be an indicator of unauthorized remote access or interactive command and control setup via remote support applications.
Identifies the installation, execution, or network activity associated with BTCPay Server across endpoints by searching file and network event tables for application artifacts, configuration files, and listening or established connections.
Detects instances of BTCPay Server versions <= 2.4.1 running on endpoints based on command-line arguments and image tags, identifying potentially vulnerable software versions.
Detects a sequence where PowerShell downloads an .msi installer file from Azure Blob Storage, followed closely by msiexec.exe spawning a PowerShell process on the same device.
Detects browser processes accessing a chatgpt.com/share/ link followed shortly thereafter by connections to multiple distinct external hosts, potentially indicating exfiltration or unauthorized interaction following an AI chat reference.
The following analytic detects taskkill.exe being launched with a process ID (/pid) argument by an executable that resides directly within
a user profile folder, such as the Downloads or Desktop folder. Filtering for parent processes located two to three directory levels deep
under root folder. This activity is significant because browser hijackers and adware droppers executed from the Downloads folder forcefully
terminate the running browser by PID so that they can modify its profile and relaunch it with their own settings. If confirmed malicious, this
could allow an attacker to tamper with browser preference files, side-load extensions and redirect the victim's browsing traffic.
a user profile folder, such as the Downloads or Desktop folder. Filtering for parent processes located two to three directory levels deep
under root folder. This activity is significant because browser hijackers and adware droppers executed from the Downloads folder forcefully
terminate the running browser by PID so that they can modify its profile and relaunch it with their own settings. If confirmed malicious, this
could allow an attacker to tamper with browser preference files, side-load extensions and redirect the victim's browsing traffic.
Detects command-line execution of script interpreters (PowerShell, CMD, MSHTA) spawned via Windows Explorer containing download primitives and URLs, followed by immediate external network connections.
Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain.
Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
Detects Microsoft Word (winword.exe) spawning the Windows command shell (cmd.exe) to execute batch scripts (.bat or .cmd files). This behavior is commonly associated with malicious document macros attempting to drop and execute secondary payloads, excluding common system paths to reduce false positives.
Detects PowerShell processes combining local loopback listener terms (such as HttpListener or TcpListener) and authentication or web request cmdlets referencing 127.0.0.1 or localhost, correlated with local network loopback connections.
The detection targets these behaviours:
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
Detects instances where an AOMEI-related process initiates an outbound WebDAV-style connection to a public host, followed closely by a Windows WebClient service (svchost.exe) connection to the same remote IP address.
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects access to Chrome or Chromium-based browser Local State files (which contain encrypted keys) by a non-browser process that correlates temporally with a PowerShell process exhibiting ClickFix-style staging characteristics (hidden window, bypass execution policy, and containing a URL).
Page 13 of 1907