Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects execution of long, obfuscated command strings initiated by Windows Explorer, often indicative of the 'ClickFix' social engineering technique where users are tricked into copying and pasting malicious commands into the Windows Run dialog.
Detects obfuscated PowerShell commands bypassing execution policy to download or execute 'configuration.ps1' or communicate with known malicious infrastructure associated with the ClickFix campaign. The rule specifically looks for caret-based obfuscation, bypass switches, and known IOCs in the command line.
Detects the execution of the Windows cipher.exe utility with the /w flag, which is used to overwrite free space on a volume to permanently delete data, a common technique for anti-forensics and data destruction.
Detects potential anti-forensic activity involving the clearing of multiple Windows Event Logs within a short time frame using the 'wevtutil' utility. This behavior is often indicative of an adversary attempting to remove traces of post-compromise activity.
Detects the execution of the Windows Recovery Environment (WinRE) management tool, reagentc.exe, with the '/disable' flag. This action disables the built-in system recovery features, which is a common tactic used by adversaries to prevent system restoration after data destruction or ransomware attacks.
This rule monitors and logs all process creation events across the environment. It captures the execution of every new process, regardless of the parent image or the binary being executed. Due to its broad scope, this rule acts as an observational baseline or telemetry collector rather than a high-fidelity detection.
This rule detects potential anti-debugging behavior characteristic of the ConfuserEx packer. It identifies processes that repeatedly poll for debugger presence (using APIs such as Debugger.IsAttached, Debugger.IsLogging, or CheckRemoteDebuggerPresent) at approximately 1-second intervals, culminating in a call to Environment.FailFast to terminate execution if a debugger is detected.
This rule detects potential anti-debugging behavior characteristic of the ConfuserEx packer. It identifies processes that repeatedly poll for debugger presence (using APIs such as Debugger.IsAttached, Debugger.IsLogging, or CheckRemoteDebuggerPresent) at approximately 1-second intervals, culminating in a call to Environment.FailFast to terminate execution if a debugger is detected.
Detects the presence of MeshAgent remote monitoring and management (RMM) software, often used for persistence or unauthorized remote access. The rule correlates process execution indicators (including potential renaming of mvtcs.exe) with network communication to known malicious infrastructure associated with Settra ransomware.
Detects when AI-powered coding assistant plugins or CLI tools (e.g., Claude, Copilot, Gemini) execute subprocesses that attempt to access sensitive configuration files, SSH keys, or cloud credential stores. This may indicate an AI tool being manipulated or misconfigured to exfiltrate sensitive local secrets.
Detects anomalous git operations initiated by AI coding agents (e.g., Claude, Copilot, Gemini-cli) that suggest potential supply chain tampering. The rule identifies attempts to checkout via a raw SHA-1 hash, git refname ambiguity warnings, or mismatches between the pinned plugin manifest commit SHA and the actual HEAD SHA resolved during operations, which may indicate a malicious substitution of code during dependency installation or updates.
Detects Settra ransomware binaries characterized by naming conventions including '_win64.exe', which create 'RESTORE_FILES.txt' ransom notes and use '.locked' or '.locked_wip' file extensions for encrypted data.
Detects instances where processes associated with Claude or Codex modify or create files within a plugin directory without a preceding legitimate installation or session command (such as 'install' or 'plugin add'). This behavior may indicate unauthorized plugin installation, persistence establishment, or malicious code injection into the development environment.
Detects the execution of obfuscated PowerShell commands initiated from the Windows Run dialog (explorer.exe). This pattern is consistent with 'ClickFix' social engineering attacks where users are coerced into copying and pasting malicious, obfuscated code into the Run dialog. The rule monitors for common obfuscation artifacts such as carets, hidden window flags, encoded command arguments, and large base64-like blobs within the command line.
This rule detects PowerShell script execution patterns indicative of the StealC 'ClickFix' infection chain. It specifically looks for the reflective loading of an obfuscated .NET assembly from memory, involving common .NET cryptographic and compression classes such as AesCryptoServiceProvider, GzipStream, and assembly loading methods like Assembly.Load. The rule uses markers and script length heuristics to identify payloads characteristic of this malware delivery technique.
Detects the creation or modification of specific system driver files (nvfsflt64.sys, Alinubx.sys) combined with the installation or initiation of a Windows service associated with NVIDIA filter names. This behavior is often indicative of persistence mechanisms, potential rootkit activity, or the deployment of vulnerable drivers (BYOVD).
This rule detects the loading of specific drivers identified as potentially associated with security software evasion or 'Bring Your Own Vulnerable Driver' (BYOVD) tactics, followed by suspicious process termination activity (e.g., termination of security-related processes or system-critical process activity) within a 15-minute window on the same device.
This rule detects the loading of specific drivers identified as potentially associated with security software evasion or 'Bring Your Own Vulnerable Driver' (BYOVD) tactics, followed by suspicious process termination activity (e.g., termination of security-related processes or system-critical process activity) within a 15-minute window on the same device.
Detects the deletion of registry keys or values associated with Chrome extension settings by processes other than chrome.exe. This activity is often associated with the removal or tampering of browser extension configurations to maintain persistence, bypass security, or disable malicious extensions during an incident response or by an attacker.
Detects the deletion of registry keys or values associated with Chrome extension settings by processes other than chrome.exe. This activity is often associated with the removal or tampering of browser extension configurations to maintain persistence, bypass security, or disable malicious extensions during an incident response or by an attacker.
This rule detects network upload operations (HTTP POST or similar requests ending in '/upload') to a specific external IP address (2.26.126.50). It specifically monitors for processes other than common web browsers, and filters for connections where significant data volume (greater than 10KB) is transferred or the data size is unknown.
Page 328 of 1908