Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
This rule monitors for network connections and process activities associated with known malicious indicators, including file hashes, C2 IP addresses, domains, and specific URLs. It maps these activities to identify potential command and control communication or other malicious network activity occurring on endpoints.
This rule monitors for network connections and process activities associated with known malicious indicators, including file hashes, C2 IP addresses, domains, and specific URLs. It maps these activities to identify potential command and control communication or other malicious network activity occurring on endpoints.
This rule monitors for network connections and process activities associated with known malicious indicators, including file hashes, C2 IP addresses, domains, and specific URLs. It maps these activities to identify potential command and control communication or other malicious network activity occurring on endpoints.
Detects specific file artifacts associated with an AsyncRAT infection chain that leverages a renamed AutoIT interpreter. The rule looks for the presence of a renamed executable, an encrypted .ini loader script, and an unnamed binary payload staged within a temporary directory, as well as associated batch script activity.
Detects the execution of MSBuild.exe initiated by PowerShell involving specific suspicious file names or extensions (.csproj, .xml) or project naming conventions, followed immediately (within 15 minutes) by an external network connection from the MSBuild process to a specific suspicious IP address or non-standard port.
This rule monitors for file creation or existence patterns in the user's Local Temp directory that are commonly associated with infostealer malware, specifically looking for naming conventions like 'evo_cl_*.exe', 'evo_db_*.db', or the presence of a 'stolen.zip' file within subdirectories.
Detects instances where the Windows Package Manager (winget.exe) initiates potentially suspicious child processes such as command shells or administrative tools, and correlates this activity with network connections originating from those child processes.
This rule detects the suspicious creation or modification of local user accounts (e.g., 'svc_ipurple') occurring within a short 15-minute window following the execution of Windows Package Manager (Winget) configuration tasks. This behavior may indicate an attacker using automated configuration files (DSC) to establish persistence or escalate privileges on a compromised system.
This rule monitors for the creation or renaming of executable files (.exe) within the 'Users\Public' directory. This directory is commonly used by adversaries for staging malicious payloads, as it is writable by standard users and often overlooked by security controls.
Detects suspicious command-line strings stored in the Windows Explorer RunMRU registry key. Adversaries may use this location to store persistence commands or to obfuscate command-line arguments that are intended to be executed by the user or via automated processes.
Detects instances where Windows Terminal (WindowsTerminal.exe) is launched by Explorer and immediately spawns a shell process (PowerShell, PWSH, or CMD), specifically excluding devices that have recorded recent RunMRU registry history. This pattern may indicate suspicious or non-interactive execution by an adversary attempting to bypass traditional shell history tracking.
Detects the use of nodejs.exe to initiate external network tunnels to known tunneling services like pinggy.io or generic tunnels using common tunnel configuration flags.
Detects the execution of PowerShell or Command Prompt with common adversarial flags (e.g., encoded commands, bypass, hidden windows) initiated by the Windows Explorer process. This pattern correlates the execution event with recent user interaction with the Windows Run MRU registry key, suggesting a possible manual execution of malicious commands via the 'Run' dialog box.
Detects usage of msiexec.exe to execute an MSI package from a remote URL. This technique is often used to download and execute malicious installers directly from the internet, bypassing local file storage.
This rule detects the execution of a specific MSI package identified by its filename and hash (MD5/SHA256). The rule monitors 'msiexec.exe' process executions and alerts when the process command line or file hash matches a known malicious indicator.
Detects the execution of cmd.exe as a child process of msiexec.exe, specifically when the command line includes 'xupdate.bat' and references a suspicious file path within 'AppData\Roaming\Traiolx Custom Utils'. This pattern is indicative of potential malicious installer abuse or software updates being used for code execution.
This rule monitors for the presence of a file named '_socket.pyd', which is a standard Python library component. The alert triggers when this file appears within a specific directory path 'Traiolx Custom Utils' or matches a known file hash associated with potentially malicious activity or unauthorized use of Python modules.
Page 227 of 1908