Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects Vidar Infostealer variants by identifying its unique per-build polymorphic virtual machine bytecode interpreter and custom ARX stream cipher. The rule uses a combination of high file entropy, lack of standard OS cryptographic API imports, and the presence of structurally invariant indirect jump-table dispatch patterns used in custom VM execution loops.
Detects the spawning of command-line interfaces such as cmd.exe, powershell.exe, or pwsh.exe as child processes of the SharePoint web application worker process (w3wp.exe). This behavior is highly irregular for a web server process and is indicative of potential exploitation, such as remote code execution (RCE) via web application vulnerabilities.
Detects the presence of specific ysoserial gadget chain strings (ActivitySurrogateSelector/ActivitySurrogateDisableTypeCheck) indicative of deserialization attacks targeting Microsoft SharePoint via System.Web.UI.LosFormatter. This typically occurs in memory within w3wp.exe processes following an initial RCE exploit, such as those targeting EditingPageParser or ToolPane.
Detects the execution of a .vbs script file that contains '.pdf' in its filename, followed within 5 minutes by the execution of a WMI query via wscript.exe. This behavior is indicative of a malicious VBScript dropper attempting to perform system discovery using WMI.
Detects the execution of Windows Script Host (wscript.exe/cscript.exe) loading WMI-related modules (wbemprox.dll, wbemcomn.dll, etc.). This pattern is often indicative of scripts attempting to query WMI for system information, environment configuration, or locale data, which is a common reconnaissance technique used by malware to identify the victim environment.
Detects the execution of a .vbs script file that contains '.pdf' in its filename, followed within 5 minutes by the execution of a WMI query via wscript.exe. This behavior is indicative of a malicious VBScript dropper attempting to perform system discovery using WMI.
Detects instances where wscript.exe deletes a .zip archive from within the C:\Users\Public\ directory structure. This activity is frequently associated with VBScript droppers performing anti-forensic cleanup by removing staged payloads after extraction but prior to execution.
This rule detects the execution of script files (such as .vbs, .vbe, .js, .jse) via wscript.exe when the file name uses a double-extension technique (e.g., .pdf.vbs) to masquerade as a benign PDF document. These files are typically found in temporary or user-download directories, indicating potential malicious activity initiated by downloaded attachments.
Detects potential malicious VBScript behavior where the script queries system language settings via WMI and subsequently launches a decoy message box commonly associated with initial-stage malware loaders or droppers to deceive users before initiating a payload download.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
Detects high or medium severity security alerts related to Kerberos Golden Ticket forgery, as identified by Microsoft Defender for Identity. This rule filters for specific alert names indicative of forged TGTs minted from the krbtgt account, excluding generic or informational ticket anomalies.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Detects potential credential reuse attacks such as Pass-the-Hash, Pass-the-Ticket, or Overpass-the-Hash. The rule identifies a 'NewCredentials' logon (e.g., runas /netonly) followed by a network or remote interactive logon to a target system (such as a domain controller) by the same user, without an interactive logon session occurring between the events, which is indicative of using stolen credentials to move laterally.
Detects two distinct behaviors indicative of potential credential theft or lateral movement: DCSync-style Active Directory replication requests identified via Event ID 4662 with specific replication GUIDs, and high-volume SMB traffic originating from Domain Controllers or DC-adjacent hosts, which may indicate unauthorized data access or credential dumping activities.
Detects two distinct behaviors indicative of potential credential theft or lateral movement: DCSync-style Active Directory replication requests identified via Event ID 4662 with specific replication GUIDs, and high-volume SMB traffic originating from Domain Controllers or DC-adjacent hosts, which may indicate unauthorized data access or credential dumping activities.
Detects HTML smuggling files identified as 'FlipBook' lures, commonly used in device-code phishing campaigns. These lures utilize client-side JavaScript for AES-GCM decryption, extensive comment-based obfuscation, and specific junk-padding techniques to bypass security controls and trick users into providing credentials.
This rule detects network activity associated with the GhostCode phishing kit. It monitors for sequential calls to the harvester backend (geoip, get_code, and poll) from specific suspicious hostnames, indicating a likely interaction between a victim and a credential harvesting landing page.
Detects a suspicious multi-stage PowerShell execution pattern where an initial process, such as explorer.exe or common loaders, invokes PowerShell with obfuscated or download-related flags (e.g., -enc, IEX, DownloadString), followed immediately by a child PowerShell process performing further download or network operations within a short time window.
Detects the launch of client32.exe (a core component of NetSupport Manager) as a child process of PowerShell, indicating potential malicious deployment of the software as a RAT rather than legitimate administrative activity.
Page 248 of 1908