Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects suspicious use of Node.js package managers running malicious lifecycle hooks, installing rogue dependencies, or invoking script execution during package installation.
Detects a sequence where a SharePoint application pool worker process (w3wp.exe) spawns a command shell (cmd.exe, powershell.exe, pwsh.exe) related to SharePoint, followed shortly (within 1 hour) by high-fidelity lateral movement tooling or remote execution techniques (such as PsExec, WMI, PowerShell remoting, or scheduled tasks) on the same host.
Detects potential mimikatz-like tools accessing LSASS from non system account
Detects outbound network connections from processes targeting a known hard-coded Potassium campaign C2 IP address (134.199.154.64), followed by fallback DNS resolver queries using standard public DNS servers by the same process.
Correlates the modification of the Explorer Policies Run registry key (specifically the 'Loader' value) with the creation or modification of a .url shortcut file in the user Startup folder on the same device within a 1-hour window, using the same initiating process.
Detects registry-based User Account Control (UAC) bypass activity where command keys for ms-settings or mscfile are created or modified under HKCU Software\Classes, correlated with a privilege adjustment (SeDebugPrivilege or SeLoadDriverPrivilege) by the same process within a 30-minute window.
Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces
Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe
Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe
Detects execution of Node.js or Bun from a temporary directory performing DNS queries for public Ethereum JSON-RPC provider domains, a technique observed in supply chain compromise payloads such as Shai-Hulud and ChainDrop to resolve command and control endpoints.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects the download of potentially suspicious executables, scripts, or archives originating from code hosting platforms like GitHub, GitLab, and various mirrors where files have low prevalence and lack valid signatures.
Detects a sequence where an UpdraftCentral management request is made to a WordPress site followed by plugin installation or user creation requests from the same source within a 30-minute window, potentially indicating unauthorized plugin installation or webshell deployment via compromised management endpoints.
Detects host-side telemetry indicating Cairn agent worker artifacts, including specific process command line terms, tsec skill files and environment variables, combined with network connections to OpenRouter from the same host.
Detects indicators of ToolShell web shell creation (spinstall0.aspx) and ASP.NET machine key harvesting activities (reading web.config or accessing validationkey/decryptionkey materials via w3wp child processes or file access audits) on SharePoint servers.
Detects a sequence where PowerShell or PWSH executes a web download referencing an .mp4 file using download cmdlets, followed within 1 hour by the execution of NetSupport Manager components (client32.exe or pcictlui.exe) from a user-writable path.
Detects newly seen devices (no Tailscale process activity in the prior 30 days) executing Tailscale enrollment or login commands followed by outbound network connections to Tailscale control infrastructure within 10 minutes, potentially indicating unauthorized VPN tunneling.
Detects outbound network connections to known ClickFix campaign domains or the execution of the finger utility connecting to public IP addresses.
Detects the creation or renaming of the 'ESX Admins' Active Directory security group combined with the addition of members to it, which is often used for privilege escalation or persistence in VMware ESXi environments managed via Active Directory.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects high volume and diverse URI requests targeting login, search, or inquiry endpoints on IIS servers within a short time window, indicative of web brute force or active reconnaissance scanning.
Detects potential data staging and exfiltration where sensitive or investigation-related files are compressed using archive utilities or PowerShell, followed closely by upload activities to Backblaze B2 cloud storage via CLI tools, rclone, or direct API connections.
Detects potential SQL injection (SQLi) attempts targeting web applications by identifying multiple requests matching specific SQLi regex patterns combined with encoding or internal reference markers within web access logs.
Page 21 of 1907