Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects command-line activity indicative of attempts to perform a DCSync attack, a method used to simulate the replication process of a Domain Controller to extract sensitive Active Directory credentials, including password hashes, using tools like Mimikatz or DSInternals.
This rule detects potential lateral movement activity by identifying the execution of PsExec service components or common lateral movement tools (PsExec, WMIC, CMD) interacting with Windows administrative shares (via UNC paths or specific network ports 135, 139, 445). It specifically looks for process creation events associated with these tools and network activity indicative of remote administration. Legitimate administrative tools signed by Microsoft or known management software (SolarWinds, Tanium, Ivanti, IBM BigFix) are explicitly excluded.
This rule detects persistence mechanisms involving the modification of Windows Registry 'Run' keys or the addition of executable/script files to the Windows Startup folder. It flags suspicious file types (vbs, js, hta, ps1, lnk) or the usage of common living-off-the-land binaries (wscript, cscript, powershell, mshta) when interacting with these persistence locations, while filtering out known benign processes like trustedinstaller.exe and explorer.exe.
Detects the execution of PowerShell processes using suspicious command-line flags, encoding, or built-in .NET network download methods (e.g., IEX, Net.WebClient, DownloadString). The rule excludes signed PowerShell binaries and common system management tools like SCCM or monitoring agents to reduce false positives.
Detects instances where a digitally signed process loads a DLL file from a user-writeable directory (such as Temp, AppData, Downloads, or Users\Public). This behavior is characteristic of DLL search order hijacking or side-loading, where an attacker attempts to load malicious code into a trusted, signed application.
Detects the execution of Grixba, a reconnaissance and inventory tool used by Play ransomware operators. The tool is designed to enumerate domain accounts, security software, backup solutions, and remote systems to facilitate reconnaissance prior to deploying encryption.
Detects remote thread creation (CreateRemoteThread or QueueUserAPC) into common Windows system processes (rundll32.exe or svchost.exe) originating from suspicious source processes. This activity is indicative of process injection techniques commonly utilized by Cobalt Strike beacons during post-exploitation, lateral movement, or ransomware deployment phases.
Detects registry modifications to CLSID InprocServer32 keys where the referenced DLL path resides in a non-standard, user-writable directory (e.g., AppData, Temp, ProgramData, Public, Recycle.Bin). This technique, known as COM Hijacking (T1546.015), is used by the Turla (also known as Snake, Secret Blizzard, Uroburos) threat group to achieve persistence by redirecting legitimate COM object references to malicious payloads.
Detects the loading of unsigned DLLs from non-system directories where the DLL filename matches common Windows system libraries. This behavior is indicative of DLL side-loading, where adversaries use a trusted, digitally-signed application to load a malicious DLL in an attempt to bypass security controls and maintain persistence.
Detects the creation of .aspx, .ashx, or .asp files within Exchange OWA/ECP or IIS wwwroot directories by web server processes (w3wp.exe or UMWorkerProcess.exe). This pattern is consistent with web shell deployment following the exploitation of public-facing web applications, a technique often used by threat actors like APT40.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects the suspicious retrieval and immediate execution of Agentic AI configuration files (e.g., AGENTS.md, KNOWLEDGE.md) from remote sources using common command-line utilities. This pattern is indicative of an adversary injecting malicious agent instructions or unauthorized configurations into an AI environment.
IOC hunt across DNS, network, and file-hash telemetry for the Ledger Google Ads phishing campaign. Vercel redirect domains are matched by exact hostname (DNS query name / parsed URL host) rather than substring, eliminating false positives from unrelated strings that merely contain a look-alike domain fragment. GCS bucket and Google Sites path IOCs remain substring-matched since the bucket IDs and page slugs are already highly specific.
Detects the presence of zero-width, non-printing, or bidirectional-override Unicode characters in command lines, commonly used for obfuscation or prompt injection.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
Detects msiexec.exe initiating network connections to or executing packages from endpoints containing 'capher.php' and token parameters. This behavior is associated with the 'ClickFix' delivery chain, where adversaries use malicious websites or scripts to trick users into downloading and executing installer files.
Detects the creation of a Windows scheduled task via schtasks.exe where the initiating process is located in common user-writable temporary or non-standard directories (e.g., AppData, Temp, or Public folders). This behavior is often indicative of malicious persistence mechanisms being established by a dropper or stage-one malware payload.
Page 32 of 465