Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule monitors for DNS queries and network traffic directed toward specific domains and subdomains identified as associated with the SpiceRAT, NodeEdgeRAT, and NomadRAT malware infrastructure. It correlates data from DNS events and general security/network logs to detect potential command and control (C2) communication patterns, regardless of specific source IP overlap.
Detects the loading of 'libcurl.dll' or related DLL patterns from suspicious directories such as '\Microsoft\Crypto\RuntimeBroker\', often associated with process masquerading or side-loading activities. The rule also monitors for the execution of suspicious binaries ('Tax_Notice_45594.exe') or binaries that mimic 'Notepad++' metadata from within these paths.
Detects outbound network connections to known command-and-control (C2) infrastructure associated with SpiceRAT, including specific malicious IP addresses and domain names used for decoy content delivery.
This rule detects outbound network connections from internal devices to a list of known malicious IP addresses associated with adversary command and control infrastructure. The rule specifically monitors connections over common ports, potentially indicating established communication with malicious servers.
Detects outbound network connections to 'acrobat-updater.com' involving suspicious API paths that mimic the Adobe Acrobat updater. This may indicate an attempt by an adversary to masquerade malicious command and control or data exfiltration as legitimate update traffic.
Detects the presence or execution of a specific file hash associated with a known malicious campaign (KREMLIN/REF9334) that leverages a signed SentinelOne binary. This indicates potential abuse of trusted code-signing to bypass security controls.
Detects the execution of PowerShell with specific command-line arguments (-NonInteractive, -NoProfile, -Command) often used by the Bird Agent backdoor or similar malicious scripts to execute code silently without user intervention or profile configuration.
Detects suspicious child processes (cmd.exe, powershell.exe, java.exe) spawned by the PaperCut NG/MF server processes (pc-app.exe or java.exe), which is indicative of potential post-exploitation activity following remote code execution.
Detects the creation of suspicious DLL or ASPX files within Microsoft Exchange or IIS directories that are associated with the GhostContainer backdoor, commonly used by the NightEagle threat actor for maintaining persistence.
Detects potential exploitation attempts against Microsoft Exchange Server, specifically targeting the ECP (Exchange Control Panel) through VIEWSTATE parameter tampering related to CVE-2020-0688, and correlates this with suspicious behavior in the w3wp.exe process, such as unauthorized module loading (e.g., clr.dll, system.web.dll) and abnormal child process creation which may indicate the deployment of in-memory backdoors like GhostContainer.
Detects DCSync activity, a method of credential dumping, by identifying DRSUAPI 'GetNCChanges' replication requests originating from a host that is not a recognized Domain Controller. The rule uses Active Directory replication GUIDs, explicit operation logs, and enriches host data to filter for illegitimate sources.
Detects the deployment of the GhostContainer backdoor, which masquerades as an IIS server component loaded within w3wp.exe. The rule monitors for command-line arguments associated with web shells and known exploitation tools like reGeorg, indicating an attempt to maintain persistence following an Exchange server compromise.
Detects suspicious process execution spawned by ScreenConnect client processes, which may indicate abuse of remote access sessions for arbitrary command execution. This includes both direct child processes of ScreenConnect client binaries and execution of binaries staged within known ScreenConnect working and temporary directories.
Detects the execution of Mimikatz or the use of specific Mimikatz command-line arguments intended to extract credentials from LSASS memory, a common technique for credential harvesting during post-exploitation activities.
Detects unauthorized file write operations performed by ScreenConnect client or service processes into client/transfer directories. This activity is indicative of exploitation attempts, specifically CVE-2026-84869, which allows for unauthorized file transfers and potential remote code execution via active ScreenConnect sessions without user confirmation.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
This rule detects a sequence of suspicious activities involving files placed in 'ProgramData\Firefox'. It identifies the creation or modification of a non-standard executable within this folder, followed by its execution by a trusted process (or itself), and the subsequent creation of a Registry run key for persistence. This pattern is often used by adversaries for persistence mechanism implementation using masqueraded file names.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
GhostContainer
YARA
Detects GhostContainer .NET-based backdoor assembly components deployed on compromised Exchange servers, requiring multiple corroborating unique indicators (module/class names, C2 header, masquerading filenames) to reduce false positives on generic .NET assemblies
GhostContainer
YARA
Detects GhostContainer .NET-based backdoor assembly components deployed on compromised Exchange servers, requiring multiple corroborating unique indicators (module/class names, C2 header, masquerading filenames) to reduce false positives on generic .NET assemblies
This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.
Page 323 of 1908