Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects execution chains where explorer.exe (acting as the Run dialog host) spawns suspicious processes like mshta.exe, powershell.exe, or cmd.exe with command lines containing URL indicators (http), common payload filenames (rtdx.dat), or specific IP address strings associated with known ClickFix social-engineering campaigns.
This rule detects instances where mshta.exe acts as a parent process to initiate powershell.exe. It specifically looks for command line arguments that employ obfuscation techniques, such as character casing variations (e.g., 'POWERsHeLl'), while simultaneously excluding standard casing, combined with flags typical of non-interactive execution (e.g., -NonInteractive or /w h /c). This pattern is commonly used by adversaries to bypass security controls and execute scripts hidden from user view.
Detects the execution of standard Windows command-line utilities (cmd.exe, wmic.exe, powershell.exe, fsutil.exe, vol.exe) used to query local volume information, such as name and serial number. This behavior is frequently associated with environment fingerprinting or sandbox evasion, particularly when executed by suspicious processes like mshta.exe as part of initial infection chains such as ClickFix payloads.
Detects execution chains where explorer.exe (acting as the Run dialog host) spawns suspicious processes like mshta.exe, powershell.exe, or cmd.exe with command lines containing URL indicators (http), common payload filenames (rtdx.dat), or specific IP address strings associated with known ClickFix social-engineering campaigns.
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
This rule detects potential command-and-control beaconing activity associated with the Go RAT used in the GapiUpdate campaign. It monitors for outbound network connections over TCP port 5556 to a known malicious C2 IP address, or alternatively, detects persistent outbound activity to other external (non-RFC1918) IP addresses characterized by multiple successive connections within a 10-minute window, which mimics the behavior of persistent beaconing.
Detects the execution of PowerShell commands that utilize both obfuscation techniques (such as Base64 encoding or 'FromBase64String') and remote payload retrieval or memory execution methods (such as 'IEX', 'DownloadString', or 'Invoke-WebRequest'). This combination is a classic indicator of malicious PowerShell activity designed to download and execute second-stage payloads.
This rule detects the creation, modification, or renaming of a browser extension's 'manifest.json' file, which is a critical configuration file for browser extensions. It correlates this file activity with simultaneous or subsequent network requests to common web-based productivity or email services (e.g., Google, Microsoft, Perplexity). This combination of file modification in an extension directory and network activity to sensitive domains may indicate the installation of a malicious browser extension designed for session hijacking or unauthorized data collection.
Detects signs of NetSupport Manager (client32.exe) establishing multiple persistence mechanisms simultaneously or in quick succession, including Windows service creation, Winlogon helper registration, Registry Run key modification, scheduled task creation, and keyboard filter driver installation. This behavior is indicative of unauthorized use of remote access tools to maintain persistence on a host.
Detects forged thread call stacks by identifying processes that spoof legitimate thread entry points such as RtlUserThreadStart and BaseThreadInitThunk in kernel32.dll, a technique commonly associated with advanced thread execution hijacking methods like SilentMoonwalk or StackMoonwalk.
Detects anomalous child processes spawned by the Microsoft Exchange IIS worker process (w3wp.exe). This activity is often observed during post-exploitation phases of vulnerabilities like ProxyLogon (CVE-2021-26855), where attackers attempt to gain code execution by spawning command shells or administrative tools from the web server process.
This rule detects the presence or execution of known files 'winfsp-x64.dll' or 'DukeQt.dll' when located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, while excluding standard system or program installation paths.
This rule detects potential defense evasion activity identified by SentinelOne as call stack spoofing. The rule triggers when behavioral indicator tags related to spoofed call stacks, thread execution masking, or suspicious indicators involving RtlUserThreadStart, BaseThreadInitThunk, or kernel32.dll are detected, suggesting an attempt to hide malicious thread execution from security monitoring tools.
Detects in-memory execution and stack-spoofing activities associated with the SparroWocky BOF loader (RunCOFF). It monitors for suspicious remote thread creation (EventCode 8), process access with highly permissive access masks (EventCode 10), and the loading of specific suspect DLLs (EventCode 7) that are indicative of this technique.
Detects instances where browser processes (chrome.exe or comet.exe) access multiple files in sensitive or unexpected directories (e.g., System32, /etc/, Documents) without an associated user click event. This activity often indicates potential malicious scripts or automated data collection running within the context of a browser process.
Detects instances of process call stack spoofing, specifically techniques like SparroWocky (hooking CreateThread to report fake start addresses such as AnimateWindow) or SilentMoonwalk (forged call stacks masking API call origins as RtlUserThreadStart or BaseThreadInitThunk) used to evade EDR behavioral monitoring.
Detects incoming HTTP requests to Microsoft Exchange servers that match patterns indicative of exploitation attempts for the ProxyLogon SSRF vulnerability (CVE-2021-26855). This includes detecting specific manipulation of the Autodiscover service and the injection of X-BEResource or X-AnonResource-Backend headers, which were commonly used during the initial access phase of this campaign.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
Page 325 of 1908