Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.
Detects browser processes accessing a chatgpt.com/share/ link followed shortly thereafter by connections to multiple distinct external hosts, potentially indicating exfiltration or unauthorized interaction following an AI chat reference.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects the writing and subsequent loading of driver files signed by a specific certificate holder (Wenjiang District Mingyu Network Technology), utilizing DeviceFileCertificateInfo, DeviceFileEvents, and DeviceImageLoadEvents.
Detects potential bootkit activity or unauthorized modifications to the EFI system partition by correlating non-standard .efi file writes with subsequent execution of boot configuration utilities like bcdedit or mountvol within a 30-minute window.
Detects potential cryptocurrency clipper malware by monitoring the staging of multiple attacker wallet addresses (BTC, ETH, TRC) under the HKCU\Software\Clipper registry path by a non-system process.
Detects when a process modifies the Windows Registry to disable zone checks (SEE_MASK_NOZONECHECKS) in the Environment key and alters settings to show hidden files (ShowSuerHidden) within 30 minutes on the same device. This behavior is commonly associated with malware attempting to execute downloaded payloads without security prompts while concealing artifacts.
Detects when a USB mass storage device is connected to a host and is followed shortly thereafter by a large volume of file creations or modifications on a removable drive, which may indicate data exfiltration or staging.
Detects potential vulnerability scanning, enumeration, or bulk data extraction against Request Tracker (RT) web paths by monitoring high request volumes, distinct URI counts, or large response byte sizes within CommonSecurityLog data.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that execute SysMon.py from the non-standard C:\Windows\SystemHealth\Update\ directory, or the corresponding scheduled task creation events.
Detects Python interpreter activity accessing multiple credential store categories (such as password managers, Discord, SSH keys, or Steam) in a short window on a single device, or specific stealer scripts associated with known file paths.
Identifies devices with Signal software flagged by Defender Vulnerability Management for CVE-2026-113380 (RingRTC before 2.72.0, hangup commands dropped when call state machine queue is flooded). Exposure rule, not an exploit detection; results are deduplicated per device and sorted by recent Signal activity.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects the execution of built-in Windows utilities such as vssadmin, wmic, wbadmin, and bcdedit performing recovery inhibition actions, including deleting volume shadow copies, resizing shadow storage, clearing the backup catalog, disabling recovery options, and configuring boot policies to ignore failures.
Detects instances of GitLab and Ruby running vulnerable software versions based on software inventory checks against fixed release versions.
The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\).
This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects a process with no prior AI API activity in the past 14 days suddenly generating a high volume (200+ calls) of network connections to public AI inference endpoints (OpenAI, Anthropic, Grok, OpenRouter). This behavior is consistent with stolen API keys being used to drain resources or exfiltrate data from a newly compromised host.
Detects execution of GoldenDMSA hacktool used for Directory Service Account manipulation.
This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains.
It leverages Sysmon Event ID 3 to surface this anomalous behavior.
Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
It leverages Sysmon Event ID 3 to surface this anomalous behavior.
Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
Page 20 of 1907