Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects high-frequency anonymous comment submissions to 'wp-comments-post.php' from a single IP address within a 10-minute window, characterized by minimal variations in User-Agent. This behavior is indicative of an automated script attempting to bypass comment moderation settings, potentially exploiting known vulnerabilities (e.g., CVE-2026-93485) to inject content without administrative approval.
Detects high-frequency anonymous comment submissions to 'wp-comments-post.php' from a single IP address within a 10-minute window, characterized by minimal variations in User-Agent. This behavior is indicative of an automated script attempting to bypass comment moderation settings, potentially exploiting known vulnerabilities (e.g., CVE-2026-93485) to inject content without administrative approval.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects execution of the CHOSEN BRICK implant (process names smdqservice.exe or winappx.exe) initiating a network connection to Telegram infrastructure (C2) followed by a network connection to a cloud object-storage provider (vultrobjects.com, storjshare.io, or backblazeb2.com) for data exfiltration within a 30-minute window.
This rule detects artifacts and behaviors associated with the WaterPlum/Contagious Interview (also known as DeceptiveDevelopment) malware suite, including BeaverTail, InvisibleFerret, and related payloads. The rule specifically targets the presence of embedded family-name strings, as well as the execution of suspicious npm package installations triggered by VS Code task automation (tasks.json) or trust prompts, common in fake technical interview attack scenarios.
This rule monitors for the installation of specific known-malicious or suspicious NPM packages that are commonly used in supply chain attacks. It identifies the execution of npm (or node) commands to install or add packages explicitly listed as malicious by security research, which may indicate a supply chain compromise or an attempt to introduce unauthorized code into the development environment.
Detects instances where a non-browser process initiates network connections to multiple AI service providers and Discord within a 15-minute correlation window, potentially indicating automated data exfiltration or unauthorized interaction with AI platforms using tools other than standard web browsers.
Detects evidence of PowerShell execution occurring within a GitLab CI runner environment that exhibits characteristics of command-and-control (C2) activity. This rule monitors PowerShell Script Block Logging (Event ID 4104) for indicators such as specific CI environment variables (e.g., CI_PIPELINE_SOURCE=api, GIT_STRATEGY=none), static job names associated with known exploitation patterns (e.g., CI_JOB_NAME=run_command), and the dynamic execution of commands using Invoke-Expression (IEX) on environmental variables.
Detects the installation of a Windows service where the ImagePath points to a gitlab-runner executable but the ServiceName deviates from the default 'gitlab-runner' name. This technique is often used to mask persistence or evade simple naming-based detections by utilizing the --service flag to rename the runner service.
Detects rapid deletion of Windows Defender or WdFilter service registry keys by non-standard processes (not System or ntoskrnl.exe). This pattern is consistent with kernel-mode tamper protection bypass attempts, such as the use of the BTR.sys driver to force the removal of defensive configuration entries, effectively disabling Windows Defender.
Detects a suspicious pattern across the environment where a large number of devices apply Group Policy Objects (GPO) shortly after rebooting. This behavior is indicative of potential unauthorized GPO modification used as a persistence or execution mechanism, where malicious logic is staged within a GPO to trigger across the domain upon machine startup.
This rule detects modifications to Group Policy Objects (GPOs) that are either explicitly marked as malicious based on known indicators (GUIDs or 'PAYLOAD' strings) or involve unauthorized modifications to domain-root or organizational unit GPO links. It monitors Active Directory security event logs for object changes.
This rule detects the creation of executable files (.exe or .dll) within the 'C:\Windows\SysWOW64\' directory by processes other than trusted Windows OS installation or servicing components. This activity is indicative of potential malware staging, side-loading, or persistence mechanisms where an adversary drops malicious payloads into a trusted system directory to evade detection.
Detects the execution of PowerShell via a shortcut (.lnk) file that attempts to download and execute remote content using 'Invoke-WebRequest'. The command lines use common obfuscation techniques like 'Hidden' window style and 'Bypass' execution policy, targeting specific known malicious URL patterns or filename keywords.
Detects endpoint, process, and network activity associated with the 'TaskStomp' threat actor, specifically targeting known malicious file hashes, command-and-control domains, and specific URLs used in their campaigns.
Detects the use of 'winget configure' to retrieve and apply a Desired State Configuration (DSC) file from a remote HTTPS URL. This behavior can be abused to execute malicious configuration scripts directly from the internet.
Detects the execution of the Python interpreter (pythonw.exe) renamed to 'codeflush.exe' residing in non-standard paths like '\Public\Music\MusicLibrariesPackage\'. This behavior is characteristic of adversaries attempting to camouflage malicious Python scripts or binaries as legitimate files to evade detection.
Detects the WinGet DSC configuration engine spawning service management processes such as sc.exe or PowerShell to create or modify Windows services. This activity is consistent with the abuse of DSC 'Service' resources to achieve persistence or privilege escalation by registering services to run as LocalSystem.
Detects anomalous file access patterns by Semantic Kernel agent processes attempting to read sensitive host files such as SSH keys, configuration files, and credential stores. This activity is indicative of malicious use of agent file-transfer capabilities, potentially exploiting path traversal vulnerabilities or prompt injection to exfiltrate sensitive data from the host environment into the agent sandbox.
Detects the use of Windows command shell variable substring expansion to obfuscate commands. Adversaries use this technique to build malicious command lines dynamically, making them less visible to standard keyword-based detection mechanisms by storing parts of strings in environment variables and reassembling them using substring notation (e.g., %var:~start,length%).
Detects potential Command and Control (C2) activity leveraging the OpenAI Assistants API. The rule identifies non-standard processes (e.g., PowerShell, Python, cmd) that establish network connections to OpenAI API endpoints, specifically those often used for interaction with AI models, suggesting potential abuse of AI services for command issuance or data exfiltration.
Page 155 of 1908