Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule monitors DeviceNetworkEvents for outbound network connections to a list of known malicious IP addresses associated with various C2 frameworks and malware families, as identified by threat intelligence feeds (e.g., ThreatFox). Identifying these connections helps detect potential C2 communication and ingress tool transfer.
This rule monitors network connections, file events, and process execution command lines for references to a list of known malicious URLs, including indicators associated with ClearFake, IClickFix, AMOS, Remus, and Mozi botnet payloads.
Detects unauthorized access or decryption attempts related to Group Policy Preferences (GPP) files stored in the SYSVOL share. Attackers often target these files to retrieve credentials stored in the 'cpassword' attribute, which can be decrypted using publicly known keys.
Detects successful network connections to a specific domain (buildersouthwestlondon.com) where the request URL path includes the string '/cloud/'. This pattern is often indicative of downloading secondary payloads, command-and-control communication, or accessing malicious infrastructure related to a specific campaign.
This rule monitors for outbound network connections to a list of known malicious IP addresses identified as part of the GhostCode command-and-control (C2) infrastructure. It uses DeviceNetworkEvents data to flag activity originating from endpoints and highlights a specific IP address used during the Intune/MDM enrollment process for further investigation.
This rule detects internal network activity (DNS queries, network connections, and security logs) communicating with domains associated with the GhostCode phishing kit. These domains are typically used to host credential harvesting pages or phishing infrastructure.
Detects network activity and HTTP request headers associated with the GhostCode phishing kit. The rule identifies specific URI patterns, custom site keys, malicious User-Agent strings, and session cookie artifacts indicative of interaction with a phishing server.
This rule detects the presence of files matching known SHA256 hashes associated with the GhostCode phishing kit. It monitors for these files both in email attachments and on local device filesystems to identify potential delivery and execution of malicious phishing payloads.
Detects the execution of wmic.exe, powershell.exe, or pwsh.exe with command-line arguments related to querying antivirus products or security centers (e.g., AntiVirusProduct, SecurityCenter2). The rule focuses on executions originating from non-standard system paths (e.g., Temp, Users, AppData) or processes that lack a valid code signing signature, which is often indicative of reconnaissance by malicious actors.
Detects mass file renaming activity associated with OpnKey ransomware, which appends specific ransom identifiers to files. This behavior is indicative of the encryption phase of a ransomware attack, where files are renamed to reflect the encryption status or to include a unique victim identifier.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects PowerShell command execution patterns indicative of the VelvetCake malware module. The rule identifies scripts that enumerate files within the C:\Users\Public directory, calculate file metrics using [math]::Round, and stage discovered files for transmission over a raw TCP connection using System.Net.Sockets.TcpClient.
Detects a malicious, trojanized Electron-based application masquerading as 'Claude Opus 5 Free Desktop'. The rule identifies specific artifacts embedded within the binary, such as GitHub repository paths, internal Electron loader scripts (snmc.js), and staging patterns associated with the RevStealer infostealer campaign attributed to the Water Curse threat actor.
Detects the use of PowerShell to load .NET Windows Forms and Drawing assemblies to perform screen captures. This behavior is associated with the VelvetCake second-stage module, which uses these libraries to capture full display screenshots and save them as timestamped PNG files to temporary directories.
Detects the RevStealer malware family using an Electron-based loader to perform anti-sandbox host validation. The loader attempts to identify virtualized environments by querying GPU hardware information using wmic or PowerShell CIM/WMI commands before proceeding to disable security features or launch the payload.
Detects the creation of a scheduled task named 'OneDriveUpdateScheduler' or the execution of a related VBScript, which are commonly used by adversaries for persistence and code execution. This rule monitors process creation events for indicators of malicious task scheduling or script execution mimicking legitimate update processes.
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
Detects unauthorized processes attempting to access sensitive application data files such as browser cookies, local state, or data stored by applications like Discord, Telegram, and Steam, which are frequent targets for credential-stealing malware.
This rule detects potentially malicious activities aimed at credential harvesting and system recovery inhibition. It monitors for the execution of vssadmin.exe with arguments to list shadow copies (often a precursor to deletion) or references to DPAPI master keys in command lines. Additionally, it identifies unauthorized processes attempting to access sensitive browser-based credential files (e.g., Login Data, Cookies, key4.db) from standard browser installation paths, specifically excluding legitimate browser and update processes.
Page 341 of 1908