Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of known PIVOTPIPE beacon binaries by matching against specific file names and SHA256 hashes. These binaries are associated with post-exploitation activities and internal network pivoting.
Detects the execution of known PIVOTPIPE RAT binary files based on their SHA256 hashes or file names. PIVOTPIPE RAT is capable of token manipulation and impersonation techniques (e.g., ImpersonateLoggedOnUser, DuplicateTokenEx) to perform privileged operations or escalate security context.
Detects Node.js processes executing suspicious command lines that involve fetching and executing remote JavaScript code. This behavior is indicative of a loader or downloader script commonly used to pull and evaluate malicious payloads at runtime, specifically referencing indicators associated with 'GHAPPIER'.
Detects instances where npm processes (install, preinstall, or postinstall) spawn suspicious child processes such as shell interpreters (cmd, powershell, bash, sh), network utilities (curl, wget), or scripting interpreters (python). This behavior is often associated with malicious npm package installation or software supply chain compromise where post-install scripts are used to gain persistence or download secondary payloads.
Detects the execution of PowerShell with hidden window arguments from explorer.exe, typically indicative of ClickFix social engineering where a user is tricked into pasting malicious commands into the Windows Run dialog.
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects instances where the system DNS process (dns.exe) on a domain controller performs recursive DNS resolution towards a set of external IP addresses associated with suspicious infrastructure (AS202412). The rule correlates this activity with recent network connections from common web browsers or system utilities (msedge.exe, svchost.exe) on the same host to identify potential proxying of malicious DNS queries.
Detects a suspicious sequence where Microsoft Outlook launches Microsoft Edge to open a URL, and that browser process subsequently makes network connections to infrastructure associated with the ClickFix phishing campaign (e.g., rsvpopenh.one or specific malicious IP).
Detects suspicious behavior where an identical executable (same path and SHA256) is launched twice within a short window (60 minutes) following a system reboot, utilizing two distinct persistence methods: one triggered via the Task Scheduler (under svchost.exe -k netsvcs) and one via a user logon autostart mechanism (spawned by explorer.exe).
This rule detects a multi-stage attack chain involving the execution of a script (likely config.cmd) via curl, followed by the modification of the Active Setup StubPath registry key for persistence, and subsequent execution of a Python script (config.py) from a non-standard location in AppData\Local\Microsoft\.
Detects instances where the system DNS process (dns.exe) on a domain controller performs recursive DNS resolution towards a set of external IP addresses associated with suspicious infrastructure (AS202412). The rule correlates this activity with recent network connections from common web browsers or system utilities (msedge.exe, svchost.exe) on the same host to identify potential proxying of malicious DNS queries.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
Detects the 'comet.exe' process (Perplexity AI agent) performing file read, write, rename, or creation operations outside of standard browser paths (e.g., AppData, Temp, Downloads). This behavior potentially indicates the process is being leveraged for unauthorized data access or staging files on the local filesystem.
Detects the use of reg.exe to query the MachineGuid value from the Windows Registry (HKLM\SOFTWARE\Microsoft\Cryptography). This behavior is often associated with adversary reconnaissance, specifically host fingerprinting, to uniquely identify compromised machines.
Page 240 of 1908