Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects exploitation attempts against CVE-2021-3156 (Baron Samedit) involving the sudoedit command invoked with the shell-mode flag (-s) and a trailing backslash argument, which is a known trigger for the heap overflow vulnerability in sudo.
Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results.
This detection focuses on the keywords that the attacker might use as a filter.
This detection focuses on the keywords that the attacker might use as a filter.
Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel
Detects a sequence of events where a known vulnerable driver is dropped or modified on a device, followed shortly by the execution of a specific callback tool (such as gbbsym.exe or symgooq.exe) or a tool matching known hashes, often associated with Bring Your Own Vulnerable Driver (BYOVD) tactics.
Detects the creation or renaming of known vulnerable drivers alongside multiple security-killer executables on a single host within a one-hour window, indicating potential preparation for Bring Your Own Vulnerable Driver (BYOVD) attacks and evasion of security controls.
Detects the AgtaBackup implant executing command shells or PowerShell sessions where the parent process is either a masqueraded Credential Guard.exe outside standard paths or associated with AgtaBackup service paths/command lines.
Detects the disguised binary 'Credential Guard.exe' accessing sensitive browser credential and cookie stores across common browsers (Chrome, Edge, Firefox, Brave, Opera), indicative of credential theft activity.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
Detects the installation of a Google Meet-named MSI package via msiexec.exe from user-writable paths or non-Google URLs, correlated with the creation of a GoogleMeet.exe binary in the Google Meet Agent directory.
Detects the AgtaBackup implant executing command shells or PowerShell sessions where the parent process is either a masqueraded Credential Guard.exe outside standard paths or associated with AgtaBackup service paths/command lines.
Detects PowerShell and msiexec activity referencing AgtaBackupAgent.msi where the parent process or initiator is associated with known Remote Monitoring and Management (RMM) tools such as LogMeIn Resolve, ConnectWise ScreenConnect, Ops RMM, or TraceRMM.
Detects the AgtaBackup implant executing command shells or PowerShell sessions where the parent process is either a masqueraded Credential Guard.exe outside standard paths or associated with AgtaBackup service paths/command lines.
Detects potential malicious software installation via two branches: Branch A identifies MSI files downloaded from suspicious URLs or with meeting/update lures (e.g., Zoom, Google Meet) followed by msiexec installation within one hour. Branch B detects msiexec command lines referencing RMM tools (ScreenConnect, LogMeIn, GoToResolve) combined with paths like Downloads, Temp, or AppData.
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Detects execution of the SpikeStrip CLI via Node.js with dynamic provider configurations for OpenAI or Anthropic, correlated with outbound network connections to their respective public APIs from the same node process.
Detects the use of the curl utility to download files from remote destinations that have not been observed in the prior 7 to 1 days, helping identify potential ingress tool transfers or anomalous data retrieval.
Detects a suspicious sequence on Linux systems where executable permissions are added to a file located in a world-writable directory (/tmp, /var/tmp, /dev/shm), followed by the execution of that same dropped or hidden file, optionally followed by cron persistence within a specified timeframe.
Detects inbound emails originating from consumer email domains with no URLs or attachments, containing invoice-related subjects, which are often used as pretext emails for vishing campaigns.
Detects the correlation within a one-hour window where a Cairn dispatcher, server, or Docker socket mounting command is executed, followed by the deployment or launch of the cairn-worker-container image using Docker.
Detects the execution of cloud command-line tools (such as tccli, aws, aliyun) on devices that have previously run a Cairn worker container or dispatcher, helping to identify potential cloud reconnaissance or management activity from compromised or containerized hosts.
Detects the Cairn dispatcher (or its uv/python launcher) spawning agent worker CLIs (claude, codex, pi) as child processes in local mode.
Page 17 of 2907