Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects a suspicious sequence of user activity where a device visits a social media platform (Twitter/X) followed shortly by navigation to a Google Doc. This pattern is often consistent with phishing lures where victims are enticed via direct messages or social engineering to open a malicious document hosted on Google Docs.
Detects HTML files utilizing the 'GhostCode' technique to hide malicious phishing redirects. The technique involves a password-protected HTML lure that uses JavaScript (Web Crypto API) to derive an AES-256-GCM key from a user-provided password via PBKDF2, decrypt an embedded ciphertext payload, and dynamically redirect the user to a concealed phishing URL.
Detects the presence and execution of components related to the 'GhostCode' activity, specifically the installation of a rogue self-signed root certificate authority (CA) masquerading as Google Trust Services and the subsequent configuration of a local TLS-intercepting proxy. The detection monitors for the creation of specific archive files, modification of the system certificate store, addition of local firewall rules, and modification of the local hosts file.
Detects a suspicious sequence where a Python process is spawned by a 'marimo' notebook process, followed immediately by an outbound SSH connection attempt from the same device. This pattern is indicative of automated or scripted lateral movement where a notebook environment is abused as a jump-point for command execution on remote systems.
Detects instances where PowerShell, cmd, or mshta are launched as child processes of browser applications or Windows Explorer, often associated with 'ClickFix' or other social engineering attacks where a user is tricked into pasting malicious commands into the Windows 'Run' dialog. The rule identifies suspicious command-line arguments typical of downloader cradles or obfuscated scripts.
This rule detects scenarios where common web browsers (e.g., chrome.exe, msedge.exe) spawn known living-off-the-land (LotL) binaries (e.g., powershell.exe, wscript.exe, mshta.exe) with command-line arguments indicative of malicious activity, such as base64-encoded strings, hidden window flags, or remote script invocation (IEX/Invoke-Expression). This pattern is frequently used in drive-by download or phishing delivery chains where an initial payload is triggered directly from a browser context.
Detects instances where mshta.exe is launched from a web browser or explorer.exe with suspicious command-line arguments, such as remote URLs, script protocols, or potentially obfuscated/base64-encoded strings, often indicative of 'ClickFix' social engineering attacks.
Detects the creation of a remote service using 'sc.exe' where the executable was recently written to an administrative share (ADMIN$ or C$). This behavior often indicates lateral movement by threat actors deploying malicious binaries as services on remote systems.
This rule detects processes other than known web browsers (Chrome, Edge, Firefox, Brave, Opera) accessing sensitive browser-related files (Login Data, Cookies, Web Data) and initiating an external network connection within 15 minutes. This behavior is highly characteristic of credential and session cookie theft, often utilized by info-stealing malware for subsequent session hijacking.
Detects the mass termination of security, backup, database, and virtualization services and processes. The rule monitors for the use of 'taskkill', 'sc', and 'net stop' commands, targeting a list of processes and services often associated with pre-encryption cleanup activities by ransomware actors to neutralize security tools and data access controls.
Detects the creation of scheduled tasks using schtasks.exe initiated by command shells where the task command points to files residing in non-standard or user-writable directories such as \Users\Public\, \PerfLogs\, or \ProgramData\. This pattern is frequently utilized by malware loaders like SocGholish, GootLoader, and various ransomware strains to achieve persistence following initial compromise.
Detects outbound network requests to Google Gemini AI API endpoints from processes that are not common web browsers or known development tools. This behavior is indicative of unauthorized use of LLM services by non-browser applications, such as the RatHat UI-automation module, for processing sensitive data or automation tasks.
Detects a browser process downloading an APK installer file from a source other than official Google Play infrastructure. This behavior is commonly associated with smishing, malvertising, and redirection to deceptive third-party application portals used to distribute malware-laced APK droppers.
Detects outbound network requests to VAPI.ai APIs that are associated with the initiation of AI-powered voice agents. This telemetry can indicate the use of automation or malicious scripts, such as those used by AnonyMousKIT to launch persona-based voice phishing (vishing) campaigns.
Detects sustained WebSocket connections to known C2 infrastructure associated with the JWR phishing framework. The rule identifies long-running sessions or frequent reconnection patterns characteristic of a live human operator interacting with a victim, as opposed to automated, one-time form submissions.
Detects the AnonyMousKIT vishing activity pattern by monitoring Twilio API call creation events followed by specific status or gather webhook callbacks from the same host within a one-hour window, consistent with automated voice phishing to collect DTMF-entered passcodes.
Detects the specific C2/WebSocket instruction sequence utilized by the JWR/Outsider phishing kit operators. The rule monitors DeviceNetworkEvents for characteristic outbound URL query parameters that indicate progress through a phishing interaction, including initial info collection (to_info), card data submission (to_card), and subsequent verification or outcome steps.
This rule detects DNS lookups, email URL clicks, and network connections involving lookalike domains that mimic Singaporean government or infrastructure services (e.g., LTA, OneMotoring, ERP, Gov.sg). It employs a regex-based pattern match for common brand-keywords combined with high-risk top-level domains, identifying potential phishing activity associated with the JWR framework that utilizes algorithmically varied, single-suffix rotated lookalike domains.
This rule detects network connections to specific domains and domain patterns that mimic legitimate entities (e.g., NinjaVan, EmiratesPost). The detection logic identifies direct matches to known malicious infrastructure and uses regular expressions to catch permutation-based typosquatting, which are common indicators of phishing or credential harvesting campaigns.
Detects SVG files containing embedded ECMAScript that executes a client-side redirect to a known AiTM phishing or C2 domain, specifically targeting the Mirage2FA delivery mechanism.
Detects HTML, XHTML, or SVG files used in Mirage2FA phishing campaigns. These files act as stagers by constructing hidden iframes to load remote JavaScript payloads from '/api/xls/' paths, utilizing specific placeholder tokens and obfuscation techniques such as XOR deobfuscation (0xAD) and custom function wrappers.
Page 249 of 1908