Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,022 detections
Filters
Last updated
All Time
Detection languages
23,931
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,580
11,924
5,908
5,189
4,871
Platforms
40,137
7,364
6,547
3,913
3,687
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
18,173
15,727
12,654
8,468
6,288
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
The rule attempts to find scheduled tasks being created via the "schtasks.exe" binary, when it's parent is "wscript" or "cscript".
Detects cmd.exe invoked with '/c move' relocating a downloaded payload into a timestamp-named appdata folder, consistent with a Lampion scheduled-task move stage.
Detects when rundll32 runs with the "jangadeiro" argument from the AppData directory.
The rule attempts to locate the use of the DLL from the lampion RAT to intercept browser credential operations, this is one of credentials theft techniques by Lampion.
Detects msiexec.exe-associated registry activity involving Chrome or Edge installation paths, matching msaRAT browser discovery before it launches a headless CDP session.
This rule detects the Download of the stager for the msaRAT directly from the IP marked as IOC
Detects creation or overwrite of the Windows shortcut name pattern observed in the Guildma Startup-folder persistence mechanism when the creator is a script interpreter, LOLBin, or process running from a user-writable location. The Cortex XDR Sigma backend maps TargetFilename to action_file_name and cannot represent the Startup directory path; use the companion native XQL rule for path-based detection.
Detects processes executing from user-writable locations connecting to TCP 8443, a behavior reported for the BraZetsu WebSocket backdoor.
Detects MsMpEng.exe writing executables or libraries into System32 or SysWOW64 directories, which can be indicative of junction-redirected remediation abuse.
This analytic detects HTTP POST requests with a declared body size of at least one megabyte that receive an HTTP 500 response or have no response status recorded.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed or unanswered uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Detects host reconnaissance activities (such as whoami or systeminfo) executed via Remote Monitoring and Management (RMM) tools or accompanied by suspicious PowerShell download and execution activity within a specific time window.
Detects the creation or modification of Windows provisioning packages (.ppkg) by processes other than expected provisioning and servicing tools. Attackers, such as those utilizing the Sirius Backdoor, can abuse custom .ppkg files to maintain persistence across OS resets.
Detects cmd.exe launching curl.exe with TLS verification disabled, redirect following, an output file, and forced hostname-to-IP resolution, or the PowerShell Invoke-WebRequest with a certificate-check bypass switch, often associated with malicious trojan droppers.
Correlates an IDE or extension host process querying api.ipify.org with a subsequent git command configuring the global user email on the same device within a 5-minute window. This behavior can be indicative of malicious setup or automated post-compromise activity.
Detects process injection targeting a web browser process.
Amatera and comparable infostealers inject into trusted browser processes
such as Chrome, Edge, Brave and Firefox to evade detection and access
credential and cookie data in memory.
Amatera and comparable infostealers inject into trusted browser processes
such as Chrome, Edge, Brave and Firefox to evade detection and access
credential and cookie data in memory.
Detects Akamai SIEM logs for PHP2Shell exploitation attempts associated with CVE-2026-109618 and CVE-2026-109619
The following analytic detects a process executing from a user-writable directory calling socket() with SOCK_RAW (a1=3) and receiving EAFNOSUPPORT (exit=-97, errno 97).
This is the kernel trigger for vhost-vsock class privilege escalation exploits.
When socket() is called with an unregistered address family and SOCK_RAW, the kernel calls request_module() to attempt to load a matching protocol module.
In vulnerable kernels, this triggers a stale IOTLB metadata cache access path that allows an unprivileged user to write an arbitrary value to modprobe_path.
The specific address family number varies by kernel and exploit variant (AF 41, 42, or any unregistered AF).
This is the kernel trigger for vhost-vsock class privilege escalation exploits.
When socket() is called with an unregistered address family and SOCK_RAW, the kernel calls request_module() to attempt to load a matching protocol module.
In vulnerable kernels, this triggers a stale IOTLB metadata cache access path that allows an unprivileged user to write an arbitrary value to modprobe_path.
The specific address family number varies by kernel and exploit variant (AF 41, 42, or any unregistered AF).
Detects potential staging and execution of files from the Microsoft Vault directory within AppData, often associated with adversary tooling or credential theft.
The following analytic detects the creation of a Temporary Access Pass (TAP) for an Azure AD user.
It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user" operation.
TAPs are time-limited passcodes that bypass all authentication requirements including MFA and FIDO2 - an attacker who
creates a TAP for a compromised account can sign in from any location without any additional factor.
If confirmed malicious, this activity provides an attacker with an unchallenged authentication path into the affected account.
It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user" operation.
TAPs are time-limited passcodes that bypass all authentication requirements including MFA and FIDO2 - an attacker who
creates a TAP for a compromised account can sign in from any location without any additional factor.
If confirmed malicious, this activity provides an attacker with an unchallenged authentication path into the affected account.
Detects execution of various PHP interpreter binaries and evaluates their version regarding the new (CVE-2026-109618 / CVE-2026-109619) if upgraded or fix is needed.
Detects non-browser clients or runtimes (such as curl, python, node, or Electron-based apps) successfully connecting to or referencing compromised eMudhra certificate status checker hosts, indicating systems that still trust compromised intermediate certificates.
Page 24 of 2906