Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule monitors DeviceNetworkEvents and DnsEvents for connections to known malicious domains and IP addresses associated with phishing campaigns. It alerts on any network communication or DNS resolution attempt targeting these indicators, providing visibility into potential user interaction with phishing infrastructure.
This rule detects network connections from internal devices to known SpiceRAT Command and Control (C2) infrastructure IPs. The detection filters for successful connections on common ports (80, 443) that meet a volume threshold, indicating potential ongoing beaconing or communication with malicious infrastructure.
ChainScript file manager 'files' task: node.exe performing high-volume recursive deletion within masqueraded ChainScript installation paths (drive enumeration, dir listing, file read/write, recursive delete)
This rule monitors DeviceNetworkEvents for any outbound network connections initiated from Windows devices to the domain 'files.surveillance-online.com', which is associated with malicious activity.
Detects the creation, modification, or execution of known malicious files associated with the Kimsuky threat actor, based on a static list of MD5 hashes observed in their campaigns.
Detects process command lines containing LLM tool-calling syntax (e.g., 'tool_call', 'function_call') in conjunction with keywords associated with offensive security capabilities (e.g., 'exploit', 'mimikatz', 'exfiltrate'). This pattern is consistent with the behavior of malicious LLM-based agents attempting to autonomously invoke and execute offensive tasks.
Detects instances where a single process on a device communicates with two or more distinct hosted LLM provider APIs (OpenAI, Anthropic, DeepSeek, Google) within a 24-hour window. This behavior is indicative of multi-model orchestration or 'consensus' techniques, which may be employed by sophisticated implants for automated tasking, data processing, or evasion.
Detects instances where a single process on a device communicates with two or more distinct hosted LLM provider APIs (OpenAI, Anthropic, DeepSeek, Google) within a 24-hour window. This behavior is indicative of multi-model orchestration or 'consensus' techniques, which may be employed by sophisticated implants for automated tasking, data processing, or evasion.
This rule monitors DeviceNetworkEvents and DnsEvents for any network connection attempts or DNS queries directed towards the known malicious domain 'hyundaiservisiankara.com'. This pattern is indicative of a host attempting to communicate with an external C2 infrastructure.
This rule detects network connections from internal devices to a list of known malicious IP addresses associated with command-and-control (C2) infrastructure. It monitors for outbound traffic across all monitored network events on endpoints.
Detects the loading of 'clr.dll' and 'System.Management.Automation.dll' (or related variants) by a process that is not a known PowerShell host. This behavior is indicative of a 'PSInline' execution technique, where an attacker leverages COM or direct assembly loading to execute PowerShell scripts or commands within a benign or malicious process to avoid spawning explicit powershell.exe processes.
This rule detects when the Node.js runtime process (node.exe) initiates the Windows command interpreter (cmd.exe) with the '/c' flag, which is commonly used to execute commands or scripts. This behavior is frequently associated with malicious Node.js activity, such as Remote Access Trojans (RATs) or web shells, which may use the shell to execute system-level operations or bypass typical application constraints.
Detects the execution of a renamed Microsoft CoreCLR Debugger (vsdbg.exe) from a directory outside of standard Visual Studio installation paths. This behavior is indicative of DLL side-loading, where a malicious vsdbg.dll is planted alongside the renamed vsdbg.exe, a technique observed in malware loader chains like Rapuncel/BoryptGrab.
This rule detects the execution, file presence, or driver loading associated with 'EDRKiller' and 'WarsawKiller', which are malicious tools used to terminate or disable endpoint security products.
Detects the execution or presence of AnyDesk.exe within directories containing 'UBP-Asset' that are outside of known, legitimate installation paths. This behavior often indicates an adversary attempting to use remote access software for persistent access or command and control, commonly disguised within unconventional directories.
Detects the execution or presence of AnyDesk.exe within directories containing 'UBP-Asset' that are outside of known, legitimate installation paths. This behavior often indicates an adversary attempting to use remote access software for persistent access or command and control, commonly disguised within unconventional directories.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
Detects attempts to exploit CVE-2021-36934 (HiveNightmare/SeriousSAM) by monitoring for unauthorized access to SAM, SYSTEM, or SECURITY hive files within Volume Shadow Copies, or the use of icacls/vssadmin to facilitate this credential access.
This rule monitors for two indicators of potentially malicious WinRM activity: first, the execution of suspicious child processes (e.g., cmd.exe, powershell.exe, rundll32.exe, certutil.exe) originating from the Windows Remote Management host process (wsmprovhost.exe); and second, a 'fan-out' pattern where a single account establishes WinRM/PSRemoting sessions on three or more distinct hosts within a short time window, which is often indicative of automated lateral movement or credential abuse.
This rule detects potentially malicious command execution by monitoring additions to the Windows Explorer RunMRU registry key. It specifically triggers when the registry data contains references to 'powershell', 'curl', or appears to be encoded/base64 strings, which are often used by adversaries to execute malicious scripts or download payloads via the Run dialog.
Detects file operations (open, read, write, rename) involving common sensitive credential files (e.g., .kdbx password databases, .ovpn and .pcf configuration files, .pem, and .ssh directory contents) by processes not authorized to interact with these files.
Page 257 of 1908