Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects anomalous behavior within a Chrome renderer process involving the acquisition of SeDebugPrivilege, preceded by ALPC, WNF, or reflective DLL loading activities. This pattern is indicative of the BlueMoon (CVE-2026-85880) kernel privilege escalation exploit chain, where a compromised low-integrity renderer leverages kernel vulnerabilities to gain elevated privileges.
Detects the creation of .iso or .zip files on Windows user directories (Desktop/Downloads) or with suspicious filenames potentially associated with phishing delivery methods.
Detects the creation of a specific JSON file named 'uploaded_files.json' within a 'SmartUploader' directory by PowerShell. This behavior may indicate an automated process, script, or actor staging data for exfiltration or managing uploaded content via PowerShell.
This rule detects the execution of a batch file named 'doxc.bat' using the Windows command shell (cmd.exe) that subsequently triggers actions related to specific file paths such as 'My_Resume.pdf' or locations in ProgramData, often associated with malicious staging or execution activity.
Detects the execution of processes named 'doxc' or 'hzwzucr_widsisa.exe', or processes matching specific file hashes, when originating from common user-writeable directories like 'ProgramData' or 'AppData'. This behavior is frequently associated with malicious payloads executing in non-standard or user-specific locations to achieve persistence or evasion.
Detects execution of Windows command shells (cmd.exe, powershell.exe) performing suspicious file deletion or renaming operations involving specific filenames associated with potentially malicious activities or malware components.
Detects the use of the 'net.exe' command-line utility to connect to the hidden IPC$ administrative share on a remote system, which is a common technique used for lateral movement and remote reconnaissance.
This rule detects potentially malicious activity by monitoring for file creation events within a specific 'FitnessPrograms' directory path and the execution of suspicious processes containing keywords related to command-and-control-like behavior (e.g., 'download_and_execute', 'checkCoachInstructions').
Detects the use of PowerShell to execute the 'Compress-Archive' cmdlet against a file named 'download.bin'. This behavior is commonly used by adversaries to compress staged data, potentially for exfiltration, or to manipulate artifacts downloaded from an external source.
Detects the creation of a scheduled task named 'StandAloneOneDriveUpdater-2626' using either PowerShell or the schtasks utility. This naming pattern is often associated with malware attempting to persist on a system by masquerading as a legitimate OneDrive update process.
Detects the execution of common command-line utilities used for network reconnaissance and discovery, such as arp, nbtstat, net, and ping. These commands are frequently used by adversaries to map network infrastructure, identify active hosts, and discover shared resources on a target network.
This rule detects unauthorized persistence attempts by monitoring for the creation of a registry value named 'DailyFitnessTracker' under the HKEY_CURRENT_USER Run key. It triggers when 'reg.exe' is used to add the key, PowerShell is used to set the registry property, or when a general registry event indicates the creation of this specific key. This behavior is indicative of a persistence mechanism designed to launch a potentially malicious or unwanted program upon user logon.
Detects the creation of hard links on a Windows system using utilities such as mklink or fsutil. Specifically, this rule identifies scenarios where a malicious executable located in %APPDATA% is linked to a backdoor binary stored in C:\ProgramData\, a technique used by adversaries to mask the true file path and evade security controls or detection mechanisms.
Detects execution of a config.bat file combined with indicators of cleanup or reference to potentially malicious LNK files and payloads (e.g., windowsysupdates.txt). The rule monitors command-line activity via Sysmon to identify potential post-exploitation staging and cleanup behavior.
Detects execution of PowerShell commands that exhibit characteristics frequently associated with malicious activity, such as reflective assembly loading, compression/decompression operations, use of specific known obfuscation markers, encoded commands, or execution originating from suspicious parent processes like explorer.exe or cmd.exe.
Detects execution of PowerShell commands that exhibit characteristics frequently associated with malicious activity, such as reflective assembly loading, compression/decompression operations, use of specific known obfuscation markers, encoded commands, or execution originating from suspicious parent processes like explorer.exe or cmd.exe.
Detects a suspicious multi-step process injection sequence originating from an obfuscated PowerShell process. The rule identifies PowerShell executing with common obfuscation flags (e.g., -enc, -nop, IEX) and performing multiple API calls (such as NtAllocateVirtualMemoryRemote, NtSetContextThreadRemote, CreateRemoteThread, or OpenProcess) targeting specific executables like csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe.
Detects a suspicious multi-step process injection sequence originating from an obfuscated PowerShell process. The rule identifies PowerShell executing with common obfuscation flags (e.g., -enc, -nop, IEX) and performing multiple API calls (such as NtAllocateVirtualMemoryRemote, NtSetContextThreadRemote, CreateRemoteThread, or OpenProcess) targeting specific executables like csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe.
Detects unauthorized processes attempting to modify, create, or rename sensitive browser files (Login Data or Cookies) belonging to Google Chrome or Microsoft Edge. The rule filters out known browser processes and looks for suspicious initiating processes characterized by unsigned code or execution from common staging areas like Temp folders.
Detects unauthorized processes attempting to modify, create, or rename sensitive browser files (Login Data or Cookies) belonging to Google Chrome or Microsoft Edge. The rule filters out known browser processes and looks for suspicious initiating processes characterized by unsigned code or execution from common staging areas like Temp folders.
Detects unauthorized processes attempting to modify, create, or rename sensitive browser files (Login Data or Cookies) belonging to Google Chrome or Microsoft Edge. The rule filters out known browser processes and looks for suspicious initiating processes characterized by unsigned code or execution from common staging areas like Temp folders.
Page 330 of 1908