Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule monitors for a variety of indicators associated with malicious activity, including connections to known malicious IP addresses, the presence of specific malicious file hashes or filenames, modifications to Windows system policies (specifically Legal Notice configuration), and changes to Active Directory Group Policy Objects using specified GUIDs.
Detects suspicious PowerShell command-line activity involving the use of encoded, obfuscated, or stealth-focused flags, as well as common patterns associated with fileless payload delivery and execution.
Detects the creation of permanent WMI event subscriptions which can be used by adversaries to establish persistence by triggering malicious code execution upon specific system events. The rule monitors Sysmon events 19, 20, and 21 as well as Microsoft-Windows-WMI-Activity logs for modifications involving Event Filters, Consumers, and Bindings, specifically looking for CommandLineEventConsumer or ActiveScriptEventConsumer.
Detects Kerberos service ticket requests (TGS-REQ) using RC4 encryption (etype 0x17) and specific ticket options (0x40810000), which are commonly associated with Kerberoasting attacks. This rule filters out service accounts (ending in $) to reduce noise, as these legitimate account types frequently request tickets.
Detects the abuse of the Windows built-in utility 'certutil.exe' to download files or decode obfuscated payloads. Attackers frequently use certutil as a Living off the Land Binary (LOLBin) to bypass security controls by leveraging its native capabilities for file transfer (via URL cache) and base64 or hexadecimal decoding.
Detects a single account requesting an abnormally large number of Kerberos service tickets (Event ID 4769) using weak RC4 encryption (0x17) within a short window. This pattern is characteristic of Kerberoasting attacks, where an adversary requests service tickets for offline password cracking.
Detects the use of PowerShell to download content from an external URL and immediately execute it in memory using common download cradles (e.g., Net.WebClient, IWR) combined with execution commands like IEX (Invoke-Expression). This is a common pattern for fileless malware delivery and post-exploitation activity.
Detects the creation or abuse of Volume Shadow Copies specifically to access the NTDS.dit file or the SYSTEM registry hive, a common technique for offline Active Directory credential dumping.
Detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook) spawn child processes that are typically associated with command interpretation, scripting, or LOLBins (Living Off the Land Binaries). This behavior is often indicative of malicious macro execution, exploit payloads, or obfuscated command execution originating from malicious documents.
Detects potential Pass-the-Hash (PtH) activity by monitoring Windows Security Event ID 4624 (Logon). The rule specifically targets logon type 9 (NewCredentials) combined with specific process/package names indicative of tools like Mimikatz, or anomalous NTLM network logons (logon type 3) that are not anonymous.
Detects instances where AI-assisted development tools (Claude, Codex, Copilot, Gemini) are used to execute git checkout commands. The rule filters for non-interactive parent processes to identify potentially automated or background execution of git operations by these development assistants.
Detects instances where AI-assisted development tools (Claude, Codex, Copilot, Gemini) are used to execute git checkout commands. The rule filters for non-interactive parent processes to identify potentially automated or background execution of git operations by these development assistants.
Detects instances where AI-assisted development tools (such as Claude, Codex, Copilot, or Gemini) initiate command-line processes (e.g., shells, interpreters, or network utilities) with arguments indicative of credential access, reconnaissance, or sensitive file interactions.
Detects the creation or abuse of Volume Shadow Copies specifically to access the NTDS.dit file or the SYSTEM registry hive, a common technique for offline Active Directory credential dumping.
Detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook) spawn child processes that are typically associated with command interpretation, scripting, or LOLBins (Living Off the Land Binaries). This behavior is often indicative of malicious macro execution, exploit payloads, or obfuscated command execution originating from malicious documents.
Detects processes opening lsass.exe with high-risk access rights consistent with credential dumping (Sysmon EventID 10), including known dumping tool patterns such as procdump or rundll32 invoking the comsvcs.dll MiniDump export.
This rule detects Terraform CLI activity interacting with suspicious domains or modules, specifically targeting known repositories or namespaces (e.g., gocommunity.io, gogets.dev). It monitors for Terraform initialization or application patterns referencing these domains in process command lines, as well as the creation of Terraform provider files within these specific namespaces. This behavior is indicative of potential supply chain compromise involving malicious Terraform modules or dependencies.
Detects execution of a specific suspicious executable file masquerading in the Windows Temp directory, coupled with the access of an associated .ini configuration file. This behavior is indicative of AsyncRAT deployment, often involving initial execution or staging of configuration files within volatile user directories.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that involve indicators often associated with malicious behavior, such as targeting temporary or publicly writable directories ('appdata', 'temp', 'programdata') or employing suspicious command-line flags (e.g., encoded commands, highest privileges, or execution on system startup).
Detects Kerberoasting activity by identifying a high volume of RC4-encrypted (0x17) Kerberos Service Ticket (TGS) requests from a single user account against multiple distinct service principal names (SPNs) within a short timeframe. This behavior is highly indicative of automated credential harvesting tools such as Rubeus or Impacket.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, backup catalogs, or disable system recovery features. The rule further correlates this activity with preceding mass file activity to identify potential ransomware or destructive attack behavior.
Page 307 of 1908