Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects the installation of a Windows service (Event IDs 4697 or 7045) where the image path executes PowerShell, rundll32, or an ADMIN$ share binary, preceded within 10 minutes by a remote admin share access (Event ID 5140 to ADMIN$ or C$). This behavior is commonly associated with lateral movement frameworks such as Cobalt Strike.
A security research repository, PSSW100AVB, by Norbert Tihanyi showcases PowerShell scripts designed to test antivirus detection and evasion.
Detects executable files saved to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints when the file has no company name in its PE version information. Commercial software almost always carries this field, while malware, masqueraded tools and quick custom builds often do not. Detection relies on file signature rather than extension. Portable utilities and internal tools also match, so triage by hash, writing process, file path and download source.
Detects automated multi-tool reconnaissance where several distinct network or web scanner tools (such as nmap, nikto, ffuf, gobuster, or dirsearch) are launched on the same device within a short time window.
Detects Phexia macOS stealer activity where osascript or shell processes query the macOS keychain for browser Safe Storage keys, followed by staging browser and extension data in temporary directories.
Detects the Phexia macOS dropper persistence mechanism where a shell script writes a plist file into ~/Library/LaunchAgents, reloads it using launchctl, and subsequently executes a base64 encoded payload piped into osascript via a shell interpreter.
Detects potential macOS dropper activity where a shell downloads a script using curl (piped or fetched) and subsequently spawns osascript to execute AppleScript commands.
Detects exploitation attempts against CVE-2021-3156 (Baron Samedit) involving the sudoedit command invoked with the shell-mode flag (-s) and a trailing backslash argument, which is a known trigger for the heap overflow vulnerability in sudo.
Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel
Detects a sequence of events where a known vulnerable driver is dropped or modified on a device, followed shortly by the execution of a specific callback tool (such as gbbsym.exe or symgooq.exe) or a tool matching known hashes, often associated with Bring Your Own Vulnerable Driver (BYOVD) tactics.
Detects the creation or renaming of known vulnerable drivers alongside multiple security-killer executables on a single host within a one-hour window, indicating potential preparation for Bring Your Own Vulnerable Driver (BYOVD) attacks and evasion of security controls.
Detects the AgtaBackup implant executing command shells or PowerShell sessions where the parent process is either a masqueraded Credential Guard.exe outside standard paths or associated with AgtaBackup service paths/command lines.
Detects the disguised binary 'Credential Guard.exe' accessing sensitive browser credential and cookie stores across common browsers (Chrome, Edge, Firefox, Brave, Opera), indicative of credential theft activity.
Detects the installation of a Google Meet-named MSI package via msiexec.exe from user-writable paths or non-Google URLs, correlated with the creation of a GoogleMeet.exe binary in the Google Meet Agent directory.
Detects the AgtaBackup implant executing command shells or PowerShell sessions where the parent process is either a masqueraded Credential Guard.exe outside standard paths or associated with AgtaBackup service paths/command lines.
Detects PowerShell and msiexec activity referencing AgtaBackupAgent.msi where the parent process or initiator is associated with known Remote Monitoring and Management (RMM) tools such as LogMeIn Resolve, ConnectWise ScreenConnect, Ops RMM, or TraceRMM.
Detects the AgtaBackup implant executing command shells or PowerShell sessions where the parent process is either a masqueraded Credential Guard.exe outside standard paths or associated with AgtaBackup service paths/command lines.
Detects potential malicious software installation via two branches: Branch A identifies MSI files downloaded from suspicious URLs or with meeting/update lures (e.g., Zoom, Google Meet) followed by msiexec installation within one hour. Branch B detects msiexec command lines referencing RMM tools (ScreenConnect, LogMeIn, GoToResolve) combined with paths like Downloads, Temp, or AppData.
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Detects execution of the SpikeStrip CLI via Node.js with dynamic provider configurations for OpenAI or Anthropic, correlated with outbound network connections to their respective public APIs from the same node process.
Detects the execution of the SpikeStrip CLI (spikestrip.mjs) or legacy sprinkle_canaries.py script using Node.js, combined with specific verb and output options for injecting/removing canary tokens and generating dynamic decoys.
Page 16 of 2907