Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the creation or modification of documents in common formats (e.g., .txt, .md, .docx, .pdf) that contain strings indicative of prompt-injection attempts. These strings are commonly used to manipulate the behavior of AI agents or Large Language Models (LLMs) that may process or index these files automatically.
Detects high-frequency authentication failures (Event ID 4625) originating from a single IP address against multiple different user accounts, indicating potential automated brute force or credential spraying activity.
Detects the creation of executable or script files (.py, .js, .mjs, .sh, .ps1) within hidden configuration directories associated with AI coding assistants and development tools (e.g., .claude, .vscode, .cursor). This activity may indicate an attempt to hijack development environments by dropping malicious scripts into locations that tools or developers might inadvertently execute or trust.
Detects instances where a GitLab Runner process (gitlab-runner-windows-amd64.exe) spawns PowerShell with flags commonly associated with bypassing execution policies and executing non-interactive commands. This behavior may indicate an attacker using a CI/CD runner as an entry point for lateral movement or command-and-control.
Detects execution of xcopy with specific flags intended to perform recursive copying of files, including hidden and system files, into a staging directory located within C:\Users\Public\. This behavior matches the known exfiltration collection routine of the NarwhalRAT malware, often invoked by processes such as python.exe or userscreen.exe.
Detects the installation or registration of the legitimate gitlab-runner.exe binary as a persistent Windows service. Adversaries can leverage this technique to establish a command-and-control (C2) channel or persistent backdoor by masquerading as legitimate CI/CD infrastructure.
Detects the BTR.sys driver, a tool identified as being extracted from Microsoft's MpEngine.dll and repurposed for kernel-level file and registry manipulation. The rule matches on specific SHA-256 file hashes or combinations of PE metadata strings, indicating the presence of this driver on the system.
Detects execution of the BTR_CLI.exe utility with specific command-line arguments. The flags monitored include -a, -chain, -item, -trigger, and -cleanup, which suggest administrative, chaining, or automated triggering behaviors of a custom or proprietary command-line interface tool. This rule tracks the command-line usage to identify potential automated task execution or system configuration changes.
Detects the creation of an NTFS Alternate Data Stream named ':changelist' on files with a .sys extension. This activity is indicative of potential malicious configuration staging or persistent storage, as seen in techniques involving BTR.sys or similar driver-based persistence mechanisms.
Detects the execution of BTR_CLI.exe with cleanup parameters that correlate with the deletion of specific registry keys (services) and related file artifacts (e.g., .dat or changelist files) within a short time window. This pattern is indicative of a post-compromise cleanup routine aimed at removing traces of malicious services or payloads.
Detects the execution of BTR_CLI.exe with command line arguments indicative of installing or interacting with the Mimikatz driver (mimidrv.sys). This behavior is associated with loading the malicious driver to facilitate credential dumping from kernel memory.
Detects the execution of BTR_CLI.exe with command line arguments indicative of installing or interacting with the Mimikatz driver (mimidrv.sys). This behavior is associated with loading the malicious driver to facilitate credential dumping from kernel memory.
Detects potential abuse of SeLoadDriverPrivilege to load unsigned or malicious drivers, often associated with Bring Your Own Vulnerable Driver (BYOVD) attacks. The rule identifies the creation of randomized service keys used to facilitate driver loading, followed by the actual loading of a driver, or explicit command-line references to the privilege being utilized.
Detects execution of JavaScript files using the Windows Script Host (wscript.exe or cscript.exe). This is a common technique used by attackers to execute malicious scripts, often delivered via phishing or as secondary payloads.
Detects instances where non-browser processes (e.g., cmd, powershell, or malicious binaries) attempt to access sensitive browser files such as 'Login Data' or 'Local State'. This is a common technique used by credential stealers to exfiltrate stored browser passwords, cookies, and configuration data.
Detects a process that deletes its own executable or script file within a short time window after launch, which is a technique used by some implants.
Detects suspicious PowerShell commands involving node.js, hidden window styles, and file downloads or transfers.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects a suspicious sequence of activity involving persistence via Registry Run keys (specifically targeting SMQDService or winappx entries) followed by modifications to Microsoft Defender configuration (adding exclusions via PowerShell) within a two-hour window on the same device.
Detects the execution of an installer file (.exe, .msi, .scr) located in common download or temporary directories that masquerades as a legitimate application (e.g., KeePass, Adobe Flash) or a medical document. The rule specifically identifies this behavior when it occurs within an hour of activity involving messaging applications like WhatsApp or Telegram, which is a known tactic in the 'CHOSEN BRICK' social engineering delivery chain.
Detects instances where the AnyDesk process spawns cmd.exe or executes a batch script, which is a common indicator of an attacker performing post-exploitation activities via a remote access session.
Page 242 of 1908