Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,680
9,759
6,693
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule monitors for the execution or interaction with macOS native security components, specifically XProtect, XProtectRemediator, and YARA-based detection processes. It flags events related to these tools as potential security telemetry, scanning activities, or remediation actions.
Detects execution of Lua/LuaJIT binaries, specifically luau.exe or lua(jit).exe, with command-line arguments referencing ico64.txt, or execution via application.cmd. This behavior is often associated with malware loaders attempting to execute secondary scripts or payloads.
Project CAV3RN
Cortex XDR
This rule monitors for indicators of compromise (IOCs) associated with a specific malicious activity or campaign, designated as 'Project CAV3RN'. It flags network communication with known malicious domains and IP addresses, as well as the execution or presence of specific file hashes and filenames (e.g., AzureCommunication.dll, logAzure.txt, NewProject.dll) related to the threat.
Detects files containing 3+ TOKYOCORE ransom note strings combined with 2+ C2-related strings (Tier 2 cluster overlap)
This rule monitors for suspicious activity often associated with credential or sensitive information discovery in development environments. It identifies: 1) Access to configuration files or directories related to AI-powered development tools (e.g., Cursor, Windsurf, Zed) which may store environment variables or API keys; 2) Network connections to common cloud instance metadata endpoints; and 3) Execution of command-line tools attempting to access AWS secrets or configuration management APIs (Secrets Manager, SSM).
Detects endpoint activity indicative of the TELEPUZ malware interacting with the Telegram API to resolve its fallback Command and Control (C2) server. The rule monitors for DNS queries, network connections, and security log entries related to the specific channel 'chanadarkpart' and common Telegram API endpoints used for retrieving message data or user profiles.
System File Execution Location Anomaly
Cortex XDR
Detects common Windows system binaries (e.g., svchost.exe, rundll32.exe, powershell.exe) executing from non-standard, suspicious file paths. This behavior is often indicative of adversaries attempting to masquerade malicious executables by renaming them or placing them in paths to mimic legitimate system processes.
Detects potential residential proxy usage based on network connections to known proxy-related ports and proxy infrastructure indicators in CrowdStrike Falcon logs.
This rule retrieves a collection of raw telemetry events including process, file, registry, and network information for a specific host (ex. HostName123). It acts as a diagnostic or hunting query to list the most recent 5,000 activities performed on the specified machine.
This rule detects potential ransomware activity by monitoring for high-frequency file rename events (more than 50 in a single dataset aggregation) or file renames resulting in the specific extension '.God8Damn'. Such patterns are highly characteristic of ransomware encrypting local or network files.
This rule detects the execution of Java JAR files from suspicious or unconventional directories (such as Temp, AppData, Downloads, or Public folders). It filters out known build tools and CI/CD agents to focus on potentially malicious or unauthorized execution of JAR files that might indicate payload staging or execution in high-risk locations.
Detects execution of the Mimikatz tool where the 'sekurlsa' module is specified in the command line. This module is commonly used to extract sensitive credential material, such as cleartext passwords and Kerberos tickets, from the LSASS process memory.
Detects the execution of unusual or unauthorized processes spawned during an 'npm install' operation, specifically those occurring within a 'node_modules' folder context. This behavior is indicative of potential supply chain attacks where a malicious package executes unauthorized code during installation.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
Detects when multiple security agent processes are terminated on a single host. Monitoring for the simultaneous or rapid termination of security products like Windows Defender, Cylance, SentinelOne, or Falcon suggests an attempt to disable endpoint protections before further malicious activity.
This rule detects processes attempting to access known cryptocurrency wallet data files. These files, such as 'wallet.dat' or 'wallet.json', are high-value targets for attackers seeking to exfiltrate cryptographic assets. The rule excludes common, legitimate cryptocurrency wallet applications that are expected to access these specific files.
Detects the creation of a local user account using net.exe or net1.exe followed immediately (within 10 minutes) by that same account being added to a local administrators group on the same device.
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window styles, and suspicious cmdlets like IEX or WebClient) when launched from explorer.exe. This pattern is commonly associated with fileless malware execution or malicious script downloads.
Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.
This rule detects scenarios where an unsigned process, originating from typical staging areas (e.g., Temp, AppData, ProgramData), performs cross-process injection (e.g., process hollowing) into a signed third-party binary. This behavior is indicative of malware loaders attempting to masquerade their execution by hiding within the context of legitimate, signed software.
Page 31 of 100