Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution or file activity associated with the 'OrionQuests-Setup.exe' installer. This rule monitors both process creation and file system activity to track the presence and usage of this specific installer executable, which may indicate the installation of potentially unauthorized or untrusted software.
Detects the execution of AutoIt-related processes from temporary directories that are attempting to load or execute suspicious .ini configuration files or specifically named executables, which is a common delivery mechanism for malware such as AsyncRAT.
This rule detects potential persistence mechanisms where a suspicious batch file (.bat) is placed within the Windows Startup folder and subsequently executed using command-line arguments that include specific file extensions like .exe and .ini. This behavior is indicative of malware, such as remote access trojans (RATs), attempting to maintain persistence upon system reboot.
This rule identifies successful network connections from local devices to a predefined list of known malicious IP addresses within the last 7 days. Such connections often indicate active communication between a compromised endpoint and adversary-controlled infrastructure.
This rule identifies successful network connections from local devices to a predefined list of known malicious IP addresses within the last 7 days. Such connections often indicate active communication between a compromised endpoint and adversary-controlled infrastructure.
Detects successful POST requests to the WordPress admin-ajax.php endpoint utilizing the 'wwlc_file_upload_handler' action with an empty referrer header. This pattern is characteristic of attackers attempting to upload malicious files via vulnerable WordPress plugins to establish web shell persistence.
Detects outbound network connections to known command-and-control IP addresses associated with the SpiceRAT malware family. The rule monitors DeviceNetworkEvents for successful connections or connection attempts over ports 80 and 443.
Detects Remote Desktop Protocol (RDP) connections established over known suspicious high ports or to specific remote IP addresses associated with known C2 operator infrastructure (SpiceRAT). This behavior indicates potential remote interactive access by an adversary.
Detects outbound network connections to known command-and-control IP addresses associated with the SpiceRAT malware family. The rule monitors DeviceNetworkEvents for successful connections or connection attempts over ports 80 and 443.
Detects Remote Desktop Protocol (RDP) connections established over known suspicious high ports or to specific remote IP addresses associated with known C2 operator infrastructure (SpiceRAT). This behavior indicates potential remote interactive access by an adversary.
Detects the creation of multiple or specific file locks that deviate from standard naming conventions, often associated with wiper malware attempting to overwrite files or fill disks by creating locking files as part of their destructive payload.
Detects the spawning of suspicious processes like cmd, powershell, or certutil by the Exchange Server's web worker process (w3wp.exe), which is a common indicator of post-exploitation activity following an initial web vulnerability exploitation, such as ProxyLogon.
Detects Python scripts containing natural-language comments that narrate attack rationale, reasoning, or step-by-step intent. This behavior is a diagnostic signature of scripts generated or operated by AI agents, which tend to document their own processes in plain text comments, unlike human-written malicious code.
Detects the execution of processes related to the 'Toy Ghouls' bird-agent tool delivery, utilizing Evil-WinRM or WinRM-fs to execute commands remotely via the WinRM service (wsmprovhost.exe).
Detects the creation of a new local user account followed by its immediate addition to the Administrators or Remote Desktop Users groups, a common pattern observed in post-exploitation activities related to CVE-2019-0708 (BlueKeep) for achieving persistent administrative access.
Detects the execution of Mimikatz, a tool commonly used for credential harvesting from Windows memory, by monitoring for processes named 'mimikatz.exe' or the presence of specific Mimikatz command-line arguments used for dumping LSASS memory or performing pass-the-hash attacks.
Detects the execution of native Windows administrative utilities (vssadmin, wmic, bcdedit, wbadmin) used by the Monkey ransomware C++ variant to delete volume shadow copies, clear the backup catalog, and disable system recovery boot policies. This activity is a characteristic precursor to data encryption.
Detects the use of offensive security tools like Evil-WinRM or winrm-fs, which are often used by threat actors for remote administration, lateral movement, or backdoor delivery via the Windows Remote Management (WinRM) protocol.
Detects the use of the Rubeus tool for Kerberos-based credential attacks, specifically Kerberoasting, TGT delegation abuse, and Pass the Ticket, by monitoring process command line arguments for characteristic flags associated with the Rubeus binary.
This rule monitors for a collection of adversarial behaviors on Windows systems, including persistence mechanisms via scheduled tasks and registry run keys, tampering with security services (VSS, Windows Defender), credential harvesting attempts (LSASS memory), log and history clearing, and external network communication to known IP geolocation services.
Detects the use of Evil-WinRM or WinRM-fs command-line utilities combined with network connections over the WinRM ports (TCP 5985/5986). This activity is indicative of remote administrative tools being used for potential lateral movement or agent delivery, specifically observed in the context of the Toy Ghouls threat activity involving the Bird Agent.
Page 347 of 1908