Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the use of PowerShell string concatenation to construct the malicious C2 domain 'merabs.pro'. This technique is used to bypass simple string-based detections that look for the full domain name in command-line arguments.
Detects the ClickFix social-engineering technique where an adversary tricks a user into pasting and executing a malicious command via Windows Explorer (Run dialog) or Windows Terminal. This pattern is often used in fake CAPTCHA or job-interview lures to achieve initial code execution.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
This rule monitors DeviceNetworkEvents for outbound network connections to a list of known malicious IP addresses associated with various C2 frameworks and malware families, as identified by threat intelligence feeds (e.g., ThreatFox). Identifying these connections helps detect potential C2 communication and ingress tool transfer.
Detects the creation of a scheduled task containing the string 'Google Chrome Update' in the command line, where the task is not the legitimate 'GoogleUpdateTaskMachine' task. The rule specifically targets tasks that execute PowerShell or arbitrary executables, which is a common persistence technique used by adversaries to mask malicious tasks as legitimate software updates.
Detects instances where the Firefox browser process executes from a path containing 'ProgramData' and creates a new file within the 'ProgramData' directory. This behavior is highly suspicious as legitimate Firefox installations reside in 'Program Files' or 'Program Files (x86)', and 'ProgramData' is often abused by malware for persistent storage or staging.
Detects instances where PowerShell is executed with a command line string containing 'Google Chrome Update' and initiates a network connection. This behavior is indicative of a malicious process masquerading as a legitimate browser update mechanism to hide network activity.
Detects the creation of scheduled tasks that masquerade as a 'Google Chrome Update' task but are initiated by suspicious processes like cmd.exe, powershell.exe, or schtasks.exe, and do not originate from the legitimate Google Chrome installation directories.
Detects usage of the Android Debug Bridge (ADB) 'pair' command initiated by processes other than known legitimate Android development tools (e.g., adb.exe, Android Studio). This may indicate an attacker attempting to wirelessly pair a malicious device or gain unauthorized access to an Android device over the network.
Detects usage of the Android Debug Bridge (ADB) 'pair' command initiated by processes other than known legitimate Android development tools (e.g., adb.exe, Android Studio). This may indicate an attacker attempting to wirelessly pair a malicious device or gain unauthorized access to an Android device over the network.
Detects a process that has established a connection to the Telegram Bot API subsequently performing a large volume of file deletions across multiple folders within a 15-minute window. This behavior is indicative of a remote-controlled destructive attack, such as the deployment of a wiper malware (e.g., HEAVYGRAM or CHOSEN BRICK) triggered via Telegram C2 commands.
Detects anomalous process execution originating from the PaperCut application server process, specifically targeting the SetupCompleted servlet endpoint. This pattern is indicative of an exploitation attempt, such as CVE-2026-81578, where unauthenticated requests trigger backend server actions before proper access validation.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects the use of native system utilities including wmic, vssadmin, and wbadmin to delete Volume Shadow Copies or the Backup Catalog, as well as the deletion of local snapshots on macOS via tmutil. These actions are common techniques employed by ransomware to prevent system restoration after encryption.
Detects the loading of the Restart Manager DLL (rstrtmgr.dll) by suspicious processes, such as those running from writable user paths (e.g., Temp, AppData) or masquerading as numeric-only named executables. Adversaries may abuse this library for process termination or interaction to facilitate malicious operations, such as clearing file locks during deployment.
Detects the execution of rundll32.exe with command-line arguments that include references to 'WindowsUpdate.log' and a specific ordinal or function index. This pattern is commonly associated with attempts to leverage rundll32.exe to execute arbitrary code while masquerading as legitimate Windows update operations.
Detects the execution of PowerShell with hidden window style and long Base64 or encoded command strings, which is a common technique used by attackers to execute obfuscated malicious scripts while minimizing visibility on the endpoint.
Detects modifications to registry keys associated with the 'ms-settings' COM object, specifically targeting the shell open command or DelegateExecute value. This technique, commonly referred to as 'ms-settings' hijacking, is used by adversaries to achieve persistence or elevated execution by redirecting legitimate COM object references to malicious payloads.
Detects when three or more critical security, database, or service processes are terminated on a Windows host within a short timeframe. This behavior is often indicative of an adversary attempting to disable security monitoring (e.g., Windows Defender/MsMpEng.exe) or perform disruptive activity against critical infrastructure (e.g., SQL Server processes).
This rule identifies potential network scanning or propagation activity by detecting a single host initiating SMB (TCP 445) connections to a high number (more than 20) of unique destination IP addresses within a given timeframe. This behavior is often indicative of internal reconnaissance, lateral movement, or worm-like propagation.
This rule detects the use of PowerShell to download common Remote Monitoring and Management (RMM) or remote access tools from the internet. This behavior is frequently associated with malicious actors attempting to establish persistent remote access to a compromised system.
Page 270 of 1908