Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Detects the execution of AutoIt3 scripts using mshta.exe as the parent process from suspicious or non-standard directories such as Temp, Downloads, or AppData. This behavior is indicative of an attempt to bypass application execution policies or obfuscate malicious script execution.
Detects the execution of AutoIt3 scripts using mshta.exe as the parent process from suspicious or non-standard directories such as Temp, Downloads, or AppData. This behavior is indicative of an attempt to bypass application execution policies or obfuscate malicious script execution.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
This rule monitors for ADFS-related security events that may indicate credential theft or authentication bypass attempts. It flags anomalous federated sign-in events (e.g., MFA bypass, unfamiliar location), unauthorized access to the ADFS DKM container in Active Directory, and suspicious attempts to export ADFS token-signing certificates.
This rule monitors for network connections to known command-and-control (C2) domains or DGA-patterned domains (ending in .icu or .cfd), as well as the execution or file creation of files matching known malicious SHA256 hashes.
Detects instances where a non-administrative user account creates two or more computer accounts within a 24-hour window. This behavior can be indicative of a compromised account attempting to add rogue machines to the domain for persistence or further lateral movement.
This rule detects potentially malicious activity targeting Microsoft Entra Connect (formerly Azure AD Connect) servers. It identifies the execution of known credential harvesting tools like AADInternals or attempts to access/extract the ADSync database files and encryption components. Such actions indicate an attempt to gain unauthorized access to synchronized identities, local domain credentials, or cloud synchronization service accounts.
This rule detects the execution, file creation, or registry modification associated with specific ScreenConnect (ConnectWise Control) installation artifacts that align with known suspicious deployment patterns. It monitors for binaries and configuration artifacts that may indicate the unauthorized installation or persistence of remote administration tools.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects the creation of Windows services using sc.exe, powershell.exe, or cmd.exe that reference specific DLL files (winfsp-x64.dll or DukeQt.dll). This behavior is often associated with persistence mechanisms or DLL hijacking/side-loading techniques where a malicious service is configured to load a specific library.
Detects process executions, file deletions, renames, and movements initiated by known SparroWocky malware files or suspicious DLLs (winfsp-x64.dll, DukeQt.dll). This monitors malicious lifecycle activity on endpoints.
This rule detects potentially malicious system configuration changes, specifically the suspension or disabling of BitLocker drive encryption via 'manage-bde.exe' and the weakening of SChannel security protocols or ciphers by modifying registry keys. These activities are indicative of an attacker attempting to bypass disk encryption or lower the security posture of network communication.
This rule identifies the execution of specific binaries (Kingsoft Office suite and Onkey/Tendyron components) from suspicious or uncommon directories such as temporary folders, user downloads, or public directories, which may indicate the staging and execution of malicious payloads masquerading as legitimate software.
Page 324 of 1908