Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that reference OneDriveUpdater or specific AccountPictures/Automata paths, which are often used by adversaries to establish persistence or run malicious code.
Detects the execution of PowerShell commands that enumerate files within sensitive user directories such as Desktop, Downloads, Documents, or OneDrive, using common cmdlets like Get-ChildItem with recurrence or filtering. This behavior is indicative of an adversary attempting to discover or stage files for exfiltration.
Detects the use of PowerShell cmdlets and parameters to perform system, hardware, and external drive discovery. This includes querying volume information, disk/partition details, and checking for removable or specific bus-type media (USB, SD, MMC), which is commonly associated with reconnaissance activities by an adversary.
Detects instances where PowerShell is executed with encoded commands, seemingly spawned by a process masquerading as or related to the Microsoft Edge Update Task. The rule specifically monitors for process chains involving 'conhost.exe' with '--headless' arguments and subsequent PowerShell execution containing encoded commands, often associated with obfuscated activity.
This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.
Detects instances where PowerShell is executed with encoded commands, seemingly spawned by a process masquerading as or related to the Microsoft Edge Update Task. The rule specifically monitors for process chains involving 'conhost.exe' with '--headless' arguments and subsequent PowerShell execution containing encoded commands, often associated with obfuscated activity.
This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.
Detects NTLM network logon events (Logon Type 3) using the NtLmSsp process where the key length is zero. This pattern is often indicative of Pass-the-Hash (PtH) attacks where the adversary uses a NTLM hash for authentication without knowing the original plaintext password.
Detects the execution of PowerShell commands that enumerate files within sensitive user directories such as Desktop, Downloads, Documents, or OneDrive, using common cmdlets like Get-ChildItem with recurrence or filtering. This behavior is indicative of an adversary attempting to discover or stage files for exfiltration.
Detects the use of net.exe or net1.exe to establish an IPC$ share connection. This is a common method for lateral movement and reconnaissance by attackers to verify administrative access or interact with remote systems via SMB. The rule specifically flags commands involving the IPC$ share, with logic to identify if a specific user was specified or if an anonymous session was attempted.
Detects the creation or start of the PSEXESVC service, which is a characteristic behavior of the PsExec tool used for remote execution and lateral movement.
This rule monitors for potential Kerberos Golden Ticket attacks by detecting specific indicators within Windows security events. It identifies Event ID 4769 with a PAC validation failure status (0x1F), and the use of weak RC4 encryption (0x17) in either TGT requests (Event ID 4768) or service ticket requests (Event ID 4769). These behaviors are often associated with forged Kerberos tickets where the attacker may be using weak encryption or malformed PAC data.
This rule detects mass file modification, creation, or renaming activity involving files with the '.krsid' extension. The threshold is set to monitor for more than 20 occurrences, which is indicative of potential ransomware encryption activity, while explicitly excluding common system, temporary, and development paths, and filtering out processes explicitly performing shadow copy deletion.
Detects Kerberos TGS (Service Ticket) requests utilizing the insecure RC4 encryption type (0x17). This pattern is a hallmark of Kerberoasting, where an attacker requests service tickets for SPNs in an attempt to crack the service account credentials offline.
Detects the creation of files within the 'AppData\Local\SystemFolder32' directory. This path is non-standard and is frequently used by malware or unauthorized scripts to conceal malicious payloads or persistence mechanisms while masquerading as legitimate system components.
Detects rapid execution of multiple native Windows discovery commands (whoami, ipconfig, hostname, tasklist) within a short window, which is often indicative of an adversary performing environment reconnaissance post-compromise.
Detects instances where Windows Explorer spawns cmd.exe to execute specific batch files (doxc.bat or config.bat), a behavior often associated with Transparent Tribe (APT36) activity involving malicious LNK shortcuts.
Detects the creation of hard links using 'mklink /H' targeting specific paths in ProgramData or linking to specific executable paths in AppData. This behavior is often indicative of adversaries attempting to perform file system manipulation for persistence, defense evasion, or masquerading.
Detects the creation of hard links using 'mklink /H' targeting specific paths in ProgramData or linking to specific executable paths in AppData. This behavior is often indicative of adversaries attempting to perform file system manipulation for persistence, defense evasion, or masquerading.
This rule detects the execution of RUSTYMOVE, a tool associated with the Transparent Tribe (APT36) threat group, which is used for propagation via removable media. It monitors for the specific executable 'Automata-20.exe', the presence of specific task-related command line arguments, the dropping of suspicious file paths, and PowerShell-based enumeration of connected USB/removable drives.
Detects the execution of HTSPnew.Exe with specific command-line arguments indicative of KRSID ransomware operations, such as configuration flags for paths, batch processing, and dry-run modes. The use of these flags with this specific executable name is a strong indicator of malicious activity.
Page 253 of 1908