Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,057 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,110
9,757
3,852
3,759
3,713
Platforms
40,057
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,879
MITRE Techniques
13,737
13,117
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects outbound network connections to 'acrobat-updater.com' involving suspicious API paths that mimic the Adobe Acrobat updater. This may indicate an attempt by an adversary to masquerade malicious command and control or data exfiltration as legitimate update traffic.
Detects the execution or invocation of processes matching a known list of malicious file hashes (SHA256). The rule monitors both direct execution (SHA256) and instances where a malicious file acts as an initiating process.
Detects the execution or invocation of processes matching a known list of malicious file hashes (SHA256). The rule monitors both direct execution (SHA256) and instances where a malicious file acts as an initiating process.
Detects execution or file presence of known malicious files based on a pre-defined list of SHA256 hashes associated with known threat activity.
Detects execution or file presence of known malicious files based on a pre-defined list of SHA256 hashes associated with known threat activity.
This rule detects outbound network connections from internal devices to a list of known malicious IP addresses associated with adversary command and control infrastructure. The rule specifically monitors connections over common ports, potentially indicating established communication with malicious servers.
Detects outbound network connections to 'acrobat-updater.com' involving suspicious API paths that mimic the Adobe Acrobat updater. This may indicate an attempt by an adversary to masquerade malicious command and control or data exfiltration as legitimate update traffic.
This rule detects network connections to a list of known lookalike domains or specific indicators (a payload GUID and a URI hash) associated with suspicious activity. It uses a time-based aggregation to identify hosts interacting with multiple suspicious domains or both specific payload indicators, suggesting potential C2 activity or a targeted phishing/malware delivery campaign.
This rule monitors network connections and HTTP requests for specific URL patterns that include encoded (base64) parameters and indicators often associated with command and control or data exfiltration. It detects endpoints accessing URLs containing a prefix sequence of 10 characters and specific endpoints like '/generate' or '/kremlin'.
This rule monitors for process execution and file activity associated with a specific file hash known to be malicious. By tracking both process and file events using a SHA256 identifier, it captures when a specific threat artifact is executed or interacted with on a system.
This rule monitors for the execution of a process that matches a specific SHA256 file hash identified as malicious.
This rule detects the presence or execution of a specific CAB file identified by its SHA256 hash. It monitors both file creation/access events and process execution events involving this hash, indicating potential malicious activity involving a known malicious cabinet file.
Detects the execution or invocation of processes matching a known list of malicious file hashes (SHA256). The rule monitors both direct execution (SHA256) and instances where a malicious file acts as an initiating process.
Detects execution or file presence of known malicious files based on a pre-defined list of SHA256 hashes associated with known threat activity.
This rule detects the process 'ShieldCrash.exe' accessing or interacting with the Windows ELAM (Early Launch Anti-Malware) configuration directory. ELAM drivers are critical components for secure boot and early malware detection; unauthorized access or manipulation by unknown processes may indicate an attempt to tamper with security tools or evade endpoint protection.
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
This rule identifies developer or contractor workstations that have Node.js/npm installed but currently lack active EDR sensor coverage (i.e., the sensor is either not onboarded or not in an active state). It employs a 24-hour grace period to filter out transient onboarding issues and ensures that the device has reported activity within the last 7 days to avoid alerting on decommissioned hardware. This gap in visibility increases the risk of undetected supply-chain malware execution and credential theft on sensitive developer endpoints.
Detects unexpected crashes or restarts of the Windows Defender service (MsMpEng.exe) occurring in temporal proximity to activities associated with the ShieldCrash PoC or tampering within the Windows Defender object manager namespace. This rule aims to identify potential exploitation attempts targeting Windows Defender, specifically correlating security service instability with known malicious indicators.
This rule detects suspicious activity involving the creation of scheduled tasks for persistence using command-line arguments indicative of tool execution (e.g., chisel, powershell) or the direct execution of hidden PowerShell scripts intended to bypass execution policy.
This rule detects suspicious activity involving the creation of scheduled tasks for persistence using command-line arguments indicative of tool execution (e.g., chisel, powershell) or the direct execution of hidden PowerShell scripts intended to bypass execution policy.
This rule detects command line patterns associated with common Impacket tools (wmiexec, psexec, smbexec) executed via Windows processes (cmd.exe, powershell.exe) or via network connections to ports 445 and 135 initiated by Python processes. These tools are frequently used by adversaries for lateral movement, remote service execution, and command execution on compromised systems.
Page 385 of 1908