Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects various common command-line techniques used for network reconnaissance and internal environment enumeration on Windows systems. It tracks the execution of native tools such as ARP for ARP cache dumping, Ping for subnet sweeps, and NetBIOS or SMB-related commands (nbtstat, net view, net share, net session) to identify remote systems, network shares, and active sessions.
Detects the suspected RUSTYMOVE activity by identifying the creation of specific malicious files (ZIP and LNK) on the root directory of removable drives, followed by reconnaissance commands targeting removable media volumes.
This rule detects PowerShell script execution that interacts with the GitHub API, specifically targeting the upload of files or JSON data to repository endpoints. The logic looks for commands related to file system access, inclusion of 'api.github.com', and references to 'SmartUploader' or 'uploaded_files.json'. It further filters for activity occurring within standard user directories and enforces a check to ensure the GitHub repository name matches the local hostname, which is a common indicator of automated exfiltration scripts.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
Detects the creation of a suspicious file named 'FitnessMonitor.exe' within the Windows Startup folder. This technique is commonly used by remote access trojans (RATs) to ensure persistent execution upon user logon.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects modifications to Active Directory user accounts (Event IDs 4720, 4738) that coincide with suspicious MFA registration indicators—such as increased device counts, software token activations, or default device/token placeholders—within one hour of a successful user authentication event. This behavior is indicative of potential account takeover or persistence activities involving MFA manipulation.
Detects evidence of the RUSTYMOVE USB-propagation tool, associated with APT36 (Transparent Tribe). The rule identifies the creation of specific staged files (DriverInstaller.zip, DocScanner-11-Aug-2026-5-37pm.pdf.LNK) at the root of removable drives, as well as the creation of a 'log.txt' file on removable media that contains markers indicating successful file copying operations.
Detects host-based network reconnaissance behaviors commonly associated with the threat group APT36 (Transparent Tribe). The rule identifies the execution of various built-in Windows network discovery commands including arp, nbtstat, net view/share/session, and automated ping sweeps or PowerShell-based subnet enumeration scripts, which are used to map reachable hosts and network shares.
Detects individual file access events performed by non-browser python processes. This rule is designed as a proxy to identify automated file collection activities, such as those performed by 'python-httpx', that may be indicative of low-volume data exfiltration when aggregated over time.
Detects the creation of specific staging files and directories associated with the Rapuncel infostealer (e.g., UserInformation.txt, installed_applications.txt, sends.log, browser_decryption.log, or the Filegraber directory) within Windows temporary storage paths. This activity typically occurs following the unauthorized collection of sensitive data such as credentials, digital wallet information, and messenger session data.
Detects the loading of the Alinubx.sys kernel driver or the creation of an NvFsFilter service, which are associated with a BYOVD (Bring Your Own Vulnerable Driver) attack leveraging a renamed CcProtect driver to bypass security protections such as PPL.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potentially malicious LDAP queries logged by Windows Server 2025 (Event IDs 3039/3040). The rule monitors for common attacker reconnaissance techniques, including Kerberoasting, AS-REP roasting, delegation abuse, AD CS enumeration, and BloodHound-style data collection patterns.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.
Detects execution of the MovieReaper initial loader binary. This malware employs advanced anti-analysis techniques, specifically manual PEB-walking to resolve APIs and evade detection by standard library loading hooks. The rule alerts on known file hashes and specific masquerading filenames.
Detects malicious activity associated with the ClickFix/Vidar campaign, where adversaries create persistence using the Windows Run registry key while masquerading as the legitimate 'VoidTools Everything.exe' utility. The rule correlates registry modifications with the creation or execution of a file path mimicking the legitimate software in suspicious locations.
This rule detects potential command and control (C2) communication and malicious process execution associated with the Vidar stealer malware. It monitors both network connections and process command lines for indicators of known Telegram C2 channels and secondary Steam community profile C2 infrastructure. The rule specifically highlights activity originating from processes other than common web browsers to identify suspicious automated beaconing or control.
Page 298 of 1908