Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,314
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects potential data exfiltration activity where a device first exhibits usage of a remote monitoring and management (RMM) tool, followed by the execution of known data transfer or exfiltration utilities such as WinSCP or Rclone.
Detects the execution of known credential theft tools such as Mimikatz, SharpDecryptPwd, and WebBrowserPassView via EDR process creation telemetry.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Identifies devices that have been enrolled within the last 30 days, displaying details such as device name, model, enrollment profile name, and enrollment date.
Summarizes the count of devices by CPU manufacturer and architecture using Kusto Query Language (KQL).
Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
Detects an uncommon svchost parent process
The following analytic detects the wermgr.exe process creating an alternate stream in the temp directory. It leverages Sysmon EventID 15 to identify these actions.
This activity is significant because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate RoguePlanet malware, which creates an alternate stream in the temp directory to execute malicious code.
If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.
This activity is significant because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate RoguePlanet malware, which creates an alternate stream in the temp directory to execute malicious code.
If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl.
URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects usage of vssadmin or wmic to delete Volume Shadow Copies
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
Detects usage of wevtutil to clear Security or System event logs
as observed in The Gentlemen ransomware operations for defense evasion and
covering tracks of their malicious activities.
as observed in The Gentlemen ransomware operations for defense evasion and
covering tracks of their malicious activities.
Detects use of wmic to add Microsoft Defender scan exclusions via the
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects SSH clients launched with reverse (-R) or dynamic (-D) port
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
Detects post-exploitation activity against Ivanti ICS / Connect Secure
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Page 30 of 1907