Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the specific fingerprinting sequence associated with Mirage2FA AiTM phishing campaigns. The detection triggers when a process downloads a specific JavaScript loader from an '/xls/' path, followed closely within two minutes by an IP/geolocation lookup request to common services (api.ipify.org, api.country.is, api.ipgeolocation.io), which is a characteristic precursor to credential interception.
Detects the presence or execution of files associated with the 'MacSync' malware family, based on a list of known MD5 file hashes.
Detects instances where a non-browser process accesses multiple distinct browser credential or session artifacts (such as Login Data, Cookies, or Local State) across different browser profiles in a short period. This behavior is indicative of credential harvesting activities, often associated with C2 frameworks or post-exploitation tools attempting to steal session cookies, 2FA backup codes, or saved passwords.
Detects processes attempting to open a handle to the Local Security Authority Subsystem Service (LSASS) process with access rights commonly associated with credential dumping. This detection focuses on identifying suspicious cross-process access requests originating from non-standard or non-authorized processes, such as those used by C2 frameworks like OnyxC2 for extracting cached Windows credentials.
Detects instances where the MSBuild.exe process is subjected to image replacement or tampering, a behavior often associated with process hollowing or malicious code injection techniques aimed at evading security defenses by masquerading as a legitimate developer utility.
Detects anomalous network polling patterns consistent with 'EvilTokens' or similar adversary-in-the-middle (AiTM) OAuth phishing kits. The rule identifies web browsers performing high-frequency, low-interval polling (3-6s) against non-reputable/unseen domains (the attacker-controlled status endpoint) immediately preceding or following successful Microsoft OAuth device-code authentication sequences.
Detects anomalous network polling patterns consistent with 'EvilTokens' or similar adversary-in-the-middle (AiTM) OAuth phishing kits. The rule identifies web browsers performing high-frequency, low-interval polling (3-6s) against non-reputable/unseen domains (the attacker-controlled status endpoint) immediately preceding or following successful Microsoft OAuth device-code authentication sequences.
Detects a sequence of potentially malicious actions indicative of credential theft, including LSASS memory access for dumping, followed by the acquisition of browser or cryptocurrency wallet files, and the subsequent staging of data in temporary directories, all correlated by the same process and device within a 15-minute window.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects the execution of PowerShell or Unix shell commands (such as those containing encoded arguments, IEX, or clipboard reading) that are initiated by GUI-based applications or interactive shell environments like Windows Explorer, terminal emulators, or runtime brokers, often indicating potential malicious command injection or living-off-the-land activity.
Detects rapid, closely-spaced network requests from the Microsoft Edge process (msedge.exe) to Microsoft-hosted domains within a very short timeframe. This behavior is indicative of a race-condition exploitation technique (CVE-2026-55945) intended to manipulate the Edge AI agent's state transitions, specifically forcing it from 'think' mode into 'act' mode to facilitate unauthorized command injection.
Detects modifications to the Windows RunMRU registry key where the value contains suspicious strings such as 'powershell', 'curl', or long encoded strings. This behavior is indicative of potential command execution, persistence, or staging via the RunMRU list.
This rule detects the creation of Windows scheduled tasks using the 'schtasks.exe' utility or events generated when a task is registered. This technique is commonly used for persistence and execution by adversaries.
Detects instances where the legitimate Windows Character Map utility (charmap.exe) is spawned by suspicious processes or PowerShell, and subsequently loads clr.dll. This behavior is indicative of potential DLL sideloading or process injection techniques used by malware to execute arbitrary code within a trusted system process context.
Detects the initiation of PowerShell by the Windows Explorer process (explorer.exe), which is often indicative of malicious activity such as lateral movement or execution of scripts originating from user-triggered actions. The rule flags command lines containing obfuscated patterns, bypass arguments, or encoded commands.
Detects when AI-powered development tools or coding assistants (such as Claude, Copilot, Gemini, or Codex) spawn suspicious child processes like command shells (cmd, powershell, bash, sh) or networking utilities (curl, wget, python). This behavior is highly atypical for integrated development environments and may indicate exploitation of the assistant's integration or malicious code execution.
Detects the execution of the C# compiler (csc.exe) initiated by PowerShell. This behavior is often indicative of in-memory compilation and execution of malicious code, bypassing traditional file-based detection.
This rule monitors for indicators of compromise (IOCs) associated with the Rapuncel/Cruciferra 'Bring Your Own Vulnerable Driver' (BYOVD) malware-as-a-service (MaaS) campaign. It detects malicious file hashes (associated with dropped binaries or drivers), connections to known malicious command-and-control (C2) IP addresses, and network requests to domains used by the infrastructure.
Detects the execution of PowerShell from a shortcut (.lnk) file, particularly when suspicious command-line arguments such as hidden windows, encoded commands, or bypass flags are utilized. This pattern is commonly associated with initial access via malicious attachments or shortcut files.
This rule identifies instances of screen capture events initiated by processes that have previously engaged in network communication with known Remote Management Tool (RMM) domains. By correlating network activity with suspicious endpoint events, it flags potential unauthorized screen scraping performed by tools often abused by attackers for post-compromise reconnaissance.
Detects the execution of PowerShell with hidden window styles and encoded command arguments initiated directly from explorer.exe. This pattern is often indicative of malicious activity, such as fileless malware execution or obfuscated script delivery, where an attacker attempts to blend in with standard user interactions.
Page 250 of 1908