Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,695
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects indicators associated with the ChatGPT Custom GPT ClickFix campaign across process, network connection, DNS, and HTTP telemetry: known malicious file hashes, C2 IP addresses, the chattypetty.com domain, and known payload-hosting URLs.
Detects browser processes performing JSON-RPC network connections to known public blockchain node providers, a network behavior characteristic of the EtherHiding technique used by the ErrTraffic MaaS platform to resolve C2 infrastructure via smart contracts. This rule identifies the network-side beaconing and should be correlated with suspicious process execution chains (e.g., browser-spawned PowerShell/cmd).
Detects the GOST tunnel binary deployed as svchost.exe from a staging directory, identified by its known hash, or by an unsigned PE importing config.dll with a matching MZ header and embedded config.dll reference (reduces FPs from legitimately signed software that imports a DLL of the same name)
Detects execution of masqueraded wsl.exe binary.
Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary,
bypassing detection based on image name alone and abusing user trust in the WSL process name.
Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary,
bypassing detection based on image name alone and abusing user trust in the WSL process name.
Detects the execution of '1.bat' when it invokes administrative or sensitive utilities such as schtasks.exe, reg.exe, or specific executables like LockScreenContentServer.exe. This activity is indicative of a persistence mechanism being established or the initiation of a DLL side-loading chain.
Detects a suspicious Microsoft Teams MSI installer (msiexec.exe) spawning a PowerShell child process or referencing a known dead-drop resolver domain. This behavior is indicative of a trojanized installer used as an initial access vector to execute malicious payloads.
The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns.
This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption.
If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption.
If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.
The following analytic detects DNS queries initiated by the Windows AI Platform to domains associated with Hugging Face, OpenAI, and other popular providers of machine learning models and services. Monitoring these DNS requests is important because it can reveal when systems are accessing external AI platforms, which may indicate the use of third-party AI resources or the transfer of sensitive data outside the organization’s environment. Detecting such activity enables organizations to enforce data governance policies, prevent unapproved use of external AI services, and maintain visibility into potential data exfiltration risks. Proactive monitoring provides better control over AI model usage and helps safeguard organizational data flows.
The following analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the `Network_Resolution` data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor. If confirmed malicious, this activity could allow attackers to bypass firewall blocks, evade detection, and maintain persistent access to the network.
Detects the use of legitimate archival utilities (such as 7-Zip, WinRAR, tar) or scripting engines (PowerShell) to compress or package sensitive browser profile artifacts like 'Login Data', 'Cookies', or 'Local State'. This behavior is a common indicator of credential harvesting and data staging activity by infostealers prior to exfiltration.
Detects the ClickFix behavioral pattern where Windows Explorer (typically triggered via the Run dialog) directly spawns PowerShell.exe. This activity is indicative of a user being socially engineered into copying and executing a malicious command from a fake CAPTCHA lure directly into the shell.
Detects a sequence of suspicious activities including local account creation, modification of account security policies, and enabling of administrative services or credential exposure settings within a short time window. This typically indicates post-exploitation behavior where an adversary is attempting to establish persistence or facilitate further lateral movement.
Detects the first-ever observed network connection from a device to WhatsApp Web or Telegram Web within a 30-day lookback period. This behavior is used to identify potentially unauthorized companion-device linking to a user's messenger account, which could indicate credential theft or unauthorized access.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit, and PowerShell) to delete Volume Shadow Copies, backup catalogs, or disable system recovery features. This is a common tactic used by ransomware and destructive actors to prevent system recovery.
Detects file system activity indicative of Royal and BlackSuit ransomware, specifically monitoring for the creation of ransom notes like 'README.TXT' or 'README.BlackSuit.txt' and mass renaming/encryption of files using extensions associated with these families (.royal, .royal_u, .blacksuit).
Detects instances where a process writes to known persistence locations, including Windows Registry Run keys, the Windows Startup folder, Linux shell profile configuration files (.bashrc/.bash_profile), and system-level task directories (cron and systemd units). This activity is often indicative of malicious persistence mechanisms, such as those used by compromised AI agents or backdoors to survive system reboots.
The following analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts.
If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
The following analytic detects the launch of common .NET-related utilities—aspnet_compiler.exe, msbuild.exe, regasm.exe, InstallUtil.exe, or vbc.exe when the parent appears to be a script (batch, CMD, PowerShell, JScript, VBScript, or HTML) running from an unusual or user-writable Windows location (for example Public, Temp, Fonts, Debug, Recycle Bin, Prefetch, or similar paths), and the child process shows little or no command-line variation from the image path or name.
That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution.
That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution.
Detects network connections or DNS resolutions to known anonymous file-sharing, cloud storage, and messaging-bot API endpoints (e.g., transfer.sh, Telegram Bot API, Discord CDN) commonly abused by adversaries for data staging and exfiltration. This rule specifically targets non-browser processes that attempt to communicate with these endpoints, helping identify potentially malicious exfiltration activities.
Detects the anomalous behavior of a Node.js process acting as a typosquatting agent. The detection identifies a node.exe process initiating a network connection to a known malicious C2 IP and port, followed by the termination of that same process within 45 seconds. This pattern is consistent with the agent crashing due to an unhandled exception (e.g., os.userInfo() failure) after beaconing.
Page 17 of 465