Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects suspicious PowerShell execution patterns involving encoded commands, hidden window styles, or common download cradles combined with code obfuscation techniques. This rule monitors PowerShell ScriptBlock Logging (Event ID 4104) for combinations of indicators often used by threat actors to evade detection, such as Base64-encoded strings, hidden execution flags, network download utilities, and script obfuscation techniques.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, backup catalogs, or disable recovery mechanisms. This behavior is commonly associated with ransomware or destructive attacks attempting to inhibit system recovery.
This rule detects attempts to perform a DCSync attack by monitoring for Windows Event ID 4662 (Object Access) with specific Directory Replication Service (DRS) GUIDs. These GUIDs are used by attackers to request the replication of sensitive data, such as password hashes, from a Domain Controller without having direct access to it. This technique is commonly used by tools like Mimikatz and Impacket's secretsdump to extract credentials from Active Directory.
This rule detects the creation of named pipes with names that match default or commonly customized patterns used by Cobalt Strike Beacons for inter-process communication (IPC) and lateral movement. The detection specifically targets common pipe naming conventions such as those starting with 'msagent_', 'MSSE-', 'postex_', 'status_', and 'mypipe-', which are frequently observed in Cobalt Strike configurations.
Detects the creation of new system services using EventID 7045 where the ImagePath points to suspicious temporary directories, administrative shares (ADMIN$), or utilizes randomly generated service names. This pattern is commonly associated with PsExec-style lateral movement and ransomware staging.
Detects PowerShell processes using the .NET System.IO.File methods (SetLastWriteTime, SetCreationTime, SetLastAccessTime) to modify file timestamps, a common anti-forensic technique to obfuscate file creation or modification times.
Detects PowerShell processes using the .NET System.IO.File methods (SetLastWriteTime, SetCreationTime, SetLastAccessTime) to modify file timestamps, a common anti-forensic technique to obfuscate file creation or modification times.
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
Detects PowerShell processes using the .NET System.IO.File methods (SetLastWriteTime, SetCreationTime, SetLastAccessTime) to modify file timestamps, a common anti-forensic technique to obfuscate file creation or modification times.
Detects process and file creation activity matching known MovieReaper loader and downstream module file hashes (MD5/SHA256). C2 IP/domain network indicators for this campaign require a separate network_connection-category rule, since Sigma logsource categories cannot be mixed within a single rule.
Detects instances where the system DNS process (dns.exe) on a domain controller performs recursive DNS resolution towards a set of external IP addresses associated with suspicious infrastructure (AS202412). The rule correlates this activity with recent network connections from common web browsers or system utilities (msedge.exe, svchost.exe) on the same host to identify potential proxying of malicious DNS queries.
Detects the execution of PowerShell or Windows Script Host (wscript/cscript) spawned by explorer.exe that utilize hidden window styles and target suspicious filenames or external paths, often indicative of a dropper or malicious script stage.
Detects Microsoft Exchange Control Panel (ECP) worker process (w3wp.exe) spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are commonly associated with the exploitation of CVE-2020-0688. This vulnerability involves unsafe deserialization within the Exchange ECP ViewState handling, which allows an attacker to execute arbitrary code with SYSTEM privileges.
Detects unauthenticated access attempts or requests originating from system/service accounts targeting the PaperCut NG/MF administrative interface, which may indicate exploitation of authentication bypass vulnerabilities (e.g., CVE-2026-81578).
Detects unauthenticated attempts to exploit CVE-2025-3248 in the Langflow 'validate/code' endpoint, characterized by missing authentication headers and the presence of suspicious Base64-encoded payloads or command execution keywords. Additionally, it identifies potential post-exploitation activity where Langflow processes spawn Python subprocesses.
Detects instances where the PaperCut application server process (pc-app.exe) or its underlying Java processes (javaw.exe or java.exe) spawn command-line interpreters such as cmd.exe or powershell.exe. This behavior is indicative of potential post-exploitation activity, specifically Remote Code Execution (RCE) via vulnerabilities targeting PaperCut servers.
This rule detects a suspicious sequence of events where a process related to Electron (a framework often used for cross-platform desktop applications) executes a hidden, obfuscated PowerShell command, followed by a subsequent PowerShell command to modify Microsoft Defender settings by adding an exclusion path for the 'AppData' directory within 10 minutes of the first process.
Sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents over a rolling 30-day window for known RevStealer indicators: exact SHA-256 matches against all 13 published file hashes, and exact-host matches (via parsed URL host, not substring) against the confirmed C2 domain meta7.archscreen68.one. An empty, extensible IP list is included for when a malicious IP is published.
Sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents over a rolling 30-day window for known RevStealer indicators: exact SHA-256 matches against all 13 published file hashes, and exact-host matches (via parsed URL host, not substring) against the confirmed C2 domain meta7.archscreen68.one. An empty, extensible IP list is included for when a malicious IP is published.
Sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents over a rolling 30-day window for known RevStealer indicators: exact SHA-256 matches against all 13 published file hashes, and exact-host matches (via parsed URL host, not substring) against the confirmed C2 domain meta7.archscreen68.one. An empty, extensible IP list is included for when a malicious IP is published.
This rule monitors for suspicious PowerShell command-line activity originating from Windows Explorer (explorer.exe) or embedded within RunMRU registry modifications. It detects obfuscated or hidden command execution patterns, such as base64 encoding, the use of -EncodedCommand, Invoke-Expression, or execution policy bypass flags, which are commonly associated with malicious scripts and fileless malware execution.
Page 262 of 1908