Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects non-browser processes initiating network connections to common file-sharing or cloud services (e.g., GitHub Gist, Telegram, Dropbox) followed by subsequent network activity from the same process within a 5-minute window. This behavior is indicative of potential command and control (C2) communication, payload retrieval, or data staging/exfiltration using legitimate web services.
Detects anomalous network connections initiated by a node.exe process spawned by npm.exe within 2 minutes of a lifecycle script (preinstall or postinstall) execution. This behavior is indicative of malicious dependency installation where a compromised package attempts to exfiltrate data or fetch additional payloads immediately upon installation.
Detects Python processes (python.exe, python3.exe, pythonw.exe) performing DNS resolution for Microsoft identity, device login, or Graph API endpoints. This activity is consistent with automated tooling, such as python-requests, performing device-code flow polling or API token authentication within an environment.
This rule detects modifications to the Windows hosts file by unauthorized processes. The hosts file is often targeted by adversaries to redirect network traffic, intercept communications, or prevent access to security-related websites.
Detects instances where a process named firefox.exe attempts to modify or create a registry run key, which is a common persistence technique, but the process file path does not correspond to the legitimate Mozilla Firefox installation directory. This behavior often indicates that an attacker is masquerading as a legitimate browser process to establish persistence.
Detects unauthorized write, create, or rename operations on the Windows HOSTS file (\drivers\etc\hosts). The rule excludes common system processes and paths associated with legitimate administrative or update activities, targeting potentially malicious attempts to redirect network traffic by modifying DNS resolution locally.
Detects the creation of a PowerShell process that identifies itself as being spawned by explorer.exe, while the process ID (PID) and parent process ID (PPID) relationship indicates inconsistency, often characteristic of the PSSpoof technique used by malware like SloppyRAT to evade detection by spoofing the process tree.
Detects the creation of a file on the system that matches a known malicious SHA256 hash.
Detects the execution of processes containing indicators associated with Alinubx or the string 222024, which are potentially linked to malicious software or unauthorized tools.
Detects the use of PowerShell to reflectively load .NET assemblies into memory, often associated with fileless malware execution. The rule monitors for common reflection-based methods (e.g., Assembly.Load, [System.Reflection.Assembly]) in conjunction with encoded command patterns or script execution.
This rule detects the creation, modification, or renaming of files that contain sensitive keywords (e.g., 'password', 'seed', 'wallet', 'recovery') by processes other than standard system or productivity applications. This activity is indicative of credential or sensitive data harvesting.
Detects the creation of a new Windows service using the service control manager command-line utility (sc.exe). This command is commonly used by attackers to achieve persistence by creating services that execute malicious binaries at startup, or to run processes with SYSTEM privileges.
This rule detects the execution of the legacy finger.exe utility when spawned by common user-facing applications (e.g., browsers, shells, explorer). The detection specifically looks for instances where the command line includes an '@' character, indicating an attempt to query information from a remote host, while excluding standard localhost queries. This pattern is often associated with reconnaissance activity or enumeration of remote users/systems.
Detects instances where a process that is not a known PowerShell host (powershell.exe, pwsh.exe, powershell_ise.exe) loads the System.Management.Automation.dll assembly, which is a strong indicator of an attempt to execute PowerShell code within a different process to evade detection.
Detects the invocation of common command-line interpreters (PowerShell or Windows Command Shell) via process creation events. This is a broad detection for administrative shell activity, which may also indicate malicious script execution or manual adversary interaction.
Detects the loading of the kernel driver 'Alinubx.sys', identified as a renamed instance of the 'CcProtect.sys' driver. This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, specifically observed in the context of Rapuncel infostealer campaigns.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
This rule detects the execution of known Remote Monitoring and Management (RMM) tools across the environment. RMM tools are frequently used by IT administrators for legitimate support, but are also commonly abused by threat actors to establish persistence and gain remote access to systems. The rule tracks the first instance of these processes appearing on any device within a 30-day window.
This rule detects potential SectopRAT loader activity by identifying non-.NET-native processes accessing 'pool.db' in the ProgramData directory followed by the immediate loading of .NET CLR libraries (clr.dll or mscoreei.dll). This pattern is indicative of reflective loading of a decrypted .NET payload into memory within a target process.
Detects potential activity related to the SectopRAT loader by monitoring the execution sequence of 'ReportDump.exe'. The rule identifies the side-loading of a specific DLL ('sdkcra.dll') followed by the process reading a known configuration or database file ('pool.db') within a short time window, which is indicative of the loader's secondary decryption phase.
Detects potential activity related to the SectopRAT loader by monitoring the execution sequence of 'ReportDump.exe'. The rule identifies the side-loading of a specific DLL ('sdkcra.dll') followed by the process reading a known configuration or database file ('pool.db') within a short time window, which is indicative of the loader's secondary decryption phase.
Page 290 of 1908