Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects execution and file artifacts associated with the 'fscan' network scanning tool, which is commonly used for internal network discovery and vulnerability scanning. The rule monitors for the presence of the fscan binary or evidence of its output files, specifically 'result.txt', often in combination with scanning parameters like port strings or target service references.
Detects the execution of PrintSpoofer or its derivatives, often used to perform privilege escalation on Windows systems by abusing the Print Spooler service. The rule also covers the download of the tool via PowerShell.
Detects the execution of 1C:Enterprise business automation software processes (1cv8.exe, 1cv8c.exe, rphost.exe) using specific suspicious external processing files (epf) such as 'Obrabotka_bez_svedeniy.epf' or 'ExternalProcessing1'. This includes detection of the file creation event to identify potential persistence or execution of malicious automation scripts within the 1C environment.
This rule detects potentially suspicious activity involving the 1C Enterprise software suite. It monitors for the execution of 'rmngr.exe' with debug flags or the spawning of processes by 'rphost.exe' that involve suspicious command files named with a 'v8_5fed' prefix located in temporary directories, which is indicative of potential exploitation attempts or unauthorized script execution within the application environment.
Detects the use of sc.exe or cplsupport.exe with command-line arguments often associated with service installation, configuration, or modification. This behavior may indicate an adversary attempting to establish persistence or escalate privileges by creating or modifying Windows services.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
Detects evidence of ONYXC2 malware activity by correlating process-related events (mutex creation, remote thread injection, named pipes) with suspicious registry key or value modifications containing the 'ONYXC2' indicator within a 5-minute window.
This rule detects when a DLL containing 'python' in its filename is loaded by a process that is not an identified Python interpreter or the dropbox.exe application. The rule specifically filters for these DLLs being larger than 10MB, which may indicate the use of embedded Python environments to facilitate malicious code execution or side-loading.
Detects a sequence of potentially malicious actions indicative of credential theft, including LSASS memory access for dumping, followed by the acquisition of browser or cryptocurrency wallet files, and the subsequent staging of data in temporary directories, all correlated by the same process and device within a 15-minute window.
Detects a sequence of potentially malicious actions indicative of credential theft, including LSASS memory access for dumping, followed by the acquisition of browser or cryptocurrency wallet files, and the subsequent staging of data in temporary directories, all correlated by the same process and device within a 15-minute window.
Detects a sequence of potentially malicious actions indicative of credential theft, including LSASS memory access for dumping, followed by the acquisition of browser or cryptocurrency wallet files, and the subsequent staging of data in temporary directories, all correlated by the same process and device within a 15-minute window.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Detects the execution or presence of AnyDesk.exe within directories containing 'UBP-Asset' that are outside of known, legitimate installation paths. This behavior often indicates an adversary attempting to use remote access software for persistent access or command and control, commonly disguised within unconventional directories.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
This rule monitors for known malicious file hashes (MD5) and network traffic (domains and specific URLs) associated with known threats. It aggregates events from DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents to identify potential interactions with threat infrastructure.
Page 334 of 1908