Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts
Detects malformed HEIF/HEIC image files with anomalous ftyp/box structure consistent with the libheif memory corruption exploit (CVE-2026-32882) used against Discourse forum image upload endpoints
Detects instances of ImageMagick binaries (convert, identify, magick) spawning suspicious child processes (e.g., shells, network tools, scripting interpreters) when processing image files with HEIF/HEIC extensions. This is a common pattern for exploiting image processing vulnerabilities (e.g., ImageTragick) to achieve remote code execution.
Detects the execution of LNK files that use a double extension (e.g., .pdf.lnk) to masquerade as PDF documents. This behavior is indicative of spear-phishing campaigns where malicious shortcuts are delivered via ZIP archives to execute hidden PowerShell commands for secondary stage downloader or persistence mechanisms.
Detects the execution of VelvetCake modular scripts by PowerShell, which involves downloading and executing scripts from %TEMP% via Invoke-Expression, and monitoring the C:\Users\Public directory for file staging and subsequent exfiltration. This rule captures the tactical loop of script execution, output file creation, and exfiltration preparation often observed in Operation Conflict Compass activity.
Detects malicious PowerShell scripts that perform a sequence of reconnaissance activities, including security product enumeration via WMI (SecurityCenter2), system configuration discovery (ipconfig, systeminfo), process enumeration, recent file access, and drive mapping. This behavior is indicative of second-stage reconnaissance by threat actors to map the target environment.
Detects Vidar Infostealer variants by identifying its unique per-build polymorphic virtual machine bytecode interpreter and custom ARX stream cipher. The rule uses a combination of high file entropy, lack of standard OS cryptographic API imports, and the presence of structurally invariant indirect jump-table dispatch patterns used in custom VM execution loops.
Detects unexpected child process execution spawned by the ScreenConnect ClientService. This activity is indicative of the exploitation of CVE-2026-84869, which allows for unauthorized file transfer and arbitrary code execution within the context of the remote support agent without requiring user interaction or confirmation.
Detects unauthorized or potentially malicious file transfer activity within ScreenConnect sessions. The rule flags file transfers occurring on vulnerable versions of ScreenConnect (prior to 26.6.5), transfers that bypass user confirmation prompts, or instances where files are transferred and subsequently executed.
This rule monitors for additions to the 'Domain Admins' group (Event IDs 4728, 4732, 4756) that occur within 15 minutes of an authentication event (Event ID 4624) involving accounts associated with PaperCut software on a Domain Controller. This pattern is indicative of a potential follow-on action after a PaperCut exploitation incident, where an attacker leverages initial access to perform privilege escalation.
This rule detects potential exploitation attempts against PaperCut servers by identifying high-frequency, consistent-interval network requests directed at PaperCut-specific URI patterns and ports, or associated with known vulnerability identifiers (CVE-2026-81578, CVE-2026-82078). The rule employs statistical analysis to identify potential automated scanning or exploitation activity, filtering out known geographic regions associated with lower-risk or irrelevant traffic.
Detects high-frequency authentication attempts originating from ScreenConnect processes on a single host within a 15-minute window. This behavior is indicative of session hijacking or authentication bypass attempts targeting ScreenConnect, such as those associated with CVE-2026-84869.
This rule monitors endpoint telemetry (File, Process, and Network events) to identify activity associated with a pre-defined set of known malicious file hashes, IP addresses, and domains. It correlates these indicators to detect potential malware execution, persistence, or command-and-control communication on monitored devices.
Detects the execution of a process named 'msedge.exe' from the 'ProgramData\Microsoft\Windows\Telemetry' directory. Legitimate Microsoft Edge executables do not run from this location, suggesting an attempt to masquerade as the legitimate browser to bypass security controls or evade detection.
This rule detects unauthorized or suspicious processes (like Python scripts or random executables) accessing Telegram Desktop's local 'tdata' directory, which contains user session information, and simultaneously exhibiting network activity directed towards Telegram API domains. This behavior is highly indicative of infostealer activity, where a malicious process attempts to harvest local Telegram session data for exfiltration.
This rule detects modifications to Microsoft Defender antivirus exclusions. Adversaries often add paths or files to the exclusion list to prevent the detection of malicious tools or staging folders during cyberattacks. The rule monitors both command-line execution of PowerShell (Add-MpPreference/Set-MpPreference) and direct registry modifications related to Windows Defender paths.
Detects the HEAVYGRAM second-stage implants 'RuntimeSSH.exe' or 'winappx.exe' establishing persistence by adding entries to Windows Registry Run or RunOnce keys.
Detects execution of potential MovieReaper loader components by monitoring for the creation of a specific, statically defined global mutex or patterns indicative of dynamic mutex naming conventions often used to ensure single-instance execution by malware.
Detects the use of PowerShell with the EncodedCommand parameter to modify or create entries in the HKEY_CURRENT_USER Run registry keys, a technique used by the HEAVYGRAM malware for persistence.
Detects the use of the Add-MpPreference cmdlet with -ExclusionPath, or processes spawned by CRUDEEXCLUDE.exe, which are associated with configuring Microsoft Defender exclusion paths. This is often used by adversaries to evade detection by excluding malicious files or directories from antivirus scanning.
This rule detects instances where Windows scripting engines (WScript or MSHTA) execute script files (WSF, VBS, HTA) which subsequently spawn a PowerShell process using encoded command arguments. This pattern is commonly used by adversaries to mask malicious payloads and bypass execution policy or simple command-line monitoring.
Page 292 of 1908