Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
This rule detects unauthorized processes modifying the 'Secure Preferences' configuration file in Google Chrome or Microsoft Edge browser data directories. This activity often indicates an attempt by malicious software to hijack browser settings, such as forcing extensions or modifying security policies, which is a common precursor to credential theft or persistent malicious access.
This rule detects network connections to known command-and-control (C2) infrastructure associated with the KREMLIN browser extension. The extension exfiltrates browser data (cookies, sessionStorage, localStorage) by masquerading data transfer within requests to .css files hosted on the attacker-controlled domain 'luizestrelhashapr.online'.
This rule monitors endpoint network events, file operations, and process executions for known malicious indicators (domains and file hashes) associated with Kremlin activity. It detects connections to suspicious remote domains and the existence or execution of specific malicious file hashes.
This rule detects the execution of the SentinelOne memory scanner process (SentinelMemoryScanner.exe) or the loading of the associated SentinelOne core library (SentinelAgentCore.dll) from a directory path outside of the standard SentinelOne installation locations (Program Files\SentinelOne or Program Files (x86)\SentinelOne). This behavior is indicative of potential masquerading or tampering where an adversary attempts to execute a renamed or moved security tool to bypass policy or evade detection.
This rule detects the execution of a specific batch file named 'Right-click to open Invoice Details.bat', or execution of a batch file matching a known malicious SHA256 hash associated with AsyncRAT distribution campaigns.
This rule detects modifications to the Windows hosts file by unauthorized processes. The hosts file is often targeted by adversaries to redirect network traffic, intercept communications, or prevent access to security-related websites.
Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.
This rule identifies the Stella_Gary modular C# backdoor framework, which has been attributed to the Kimsuky (APT-C-55) threat group. The rule functions by detecting specific naming conventions within the binary and the presence of .NET assembly loading capabilities combined with plugin management functionality, characteristic of this modular malware family.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., -enc, -nop, -windowstyle hidden) originating from an LNK file launched by explorer.exe. This pattern is commonly used by adversaries to execute obfuscated malicious payloads embedded within shortcut files.
Detects unauthorized processes attempting to access browser credential database files such as Login Data for Chromium-based browsers or logins.json and key4.db for Firefox. The rule filters out known browser processes to isolate potential credential harvesting or exfiltration activity.
This rule detects suspicious process command-line activity on devices identified as ATMs. It looks for known malware-related executables (CSCSERVICE.EXE) and common ATM software components (DISPENSR, XFS, MSXFS, AGILIS, APTRA, PROCASH, *.xfs) being executed or initiated by unusual processes like svchost.exe, rundll32.exe, or regsvr32.exe. This activity could indicate an attempt at ATM jackpotting or other unauthorized access.
Detects network activity and HTTP request headers associated with the GhostCode phishing kit. The rule identifies specific URI patterns, custom site keys, malicious User-Agent strings, and session cookie artifacts indicative of interaction with a phishing server.
This rule monitors the Microsoft IIS worker process (w3wp.exe) for the spawning of suspicious child processes often associated with web shell activity, such as command shells (cmd.exe, powershell.exe) or compiler/utility tools (csc.exe, cvtres.exe, rundll32.exe, regsvr32.exe). It further filters for command lines containing Exchange or OWA-related strings, and flags executions containing known web shell indicators (e.g., VIEWSTATE, GhostWebShell, reGeorg).
Detects a large volume of file write, rename, or creation operations within a single minute by a single process, concurrently with the creation of files containing common ransomware keywords (e.g., 'readme', 'decrypt', 'how_to'). This behavior is characteristic of ransomware encryption activities.
This rule monitors command-line activity for common scripting interpreters (Python, PowerShell, Bash, CMD) and flags processes that contain suspicious commentary. It looks for excessive use of comments (3 or more) or specific narrative phrases often found in malicious scripts, such as references to encrypting, dropping, deleting, or escalating privileges, which are indicative of obfuscated or malicious intent.
This rule detects a sequence of suspicious events related to the 'ENCFORGE' threat actor or toolset. It monitors for evidence of initial access (via validation/code API calls), command and control communication (to specific IP/port), and destructive impact, correlating these activities within a 4-hour window on the same host.
Detects the execution of powershell.exe or cmd.exe with a combination of -NonInteractive, -NoProfile, and -Command arguments. This combination is frequently used by adversaries to execute scripts or commands stealthily, without user interaction or loading profile configuration files, which is a common behavior during the execution phase of an attack.
Detects suspicious Python execution patterns commonly associated with web shells or remote code execution, originating from typical web server or application middleware processes (e.g., w3wp, nginx, httpd, tomcat). The detection triggers on specific patterns including base64-encoded command execution, Python evaluation of base64-encoded strings, or long alphanumeric command-line strings suggesting obfuscated code execution.
This rule monitors for suspicious process execution patterns that suggest system tampering, security tool evasion, or data concealment. It detects activities such as clearing event logs, modifying Windows Defender preferences (exclusions/real-time monitoring), creating suspicious scheduled tasks, deleting volume shadow copies, and using PowerShell for credential or system state manipulation.
Detects Python scripts that exhibit behavioral characteristics of agentic or LLM-generated malicious code. This is identified by the presence of self-narrating comments describing intent, next steps, or staging/exfiltration actions, combined with hardcoded indicators for the JADEPUFFER staging infrastructure.
Page 321 of 1908