Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
This rule detects potential web shell activity by identifying instances where a web server process creates or modifies a PHP file within a 'wp-content/themes' directory, followed closely (within 15 minutes) by that same web server process spawning a shell process (e.g., sh, bash, cmd.exe).
Detects modifications to the 'HKCU\Software\Classes\ms-settings\shell\open\command' registry key, a technique used to hijack the fodhelper.exe binary to achieve silent UAC elevation. This allows attackers to execute commands with administrative privileges without triggering a UAC prompt.
Detects the execution of hidden, base64-encoded PowerShell commands spawned directly from explorer.exe, a pattern observed in the CRPx0 ClickFix campaign where attackers trick users into pasting malicious commands into the Windows Run dialog.
Detects execution of rundll32.exe using ordinal-based export calling syntax to load suspicious DLLs (e.g., sys_<hex>.dll) or reference non-executable files (e.g., WindowsUpdate.log). This behavior is consistent with the CRPx0 Stage 2 stager, which typically exports crypto globals and lacks standard named exports.
Detects host and user discovery commands (whoami, hostname, systeminfo, wmic) executed within a 15-minute window following a suspected CRPx0 ransomware execution event, identified by either encoded PowerShell or curl-to-bash activity.
Detects potential lateral movement activity associated with the CRPx0 propagation technique. The rule monitors for WmiPrvSE.exe spawning unusual child processes (indicative of remote Win32_Process.Create execution) which are concurrently correlated with outbound network activity from the same host.
Detects usage of the 'gem' command (install, build, push, publish) that includes naming patterns or specific command strings associated with the GemStuffer supply chain compromise campaign. This targets attempts to introduce malicious dependencies into the environment using RubyGems.
Detects the execution of known potentially malicious tools cplsupport.exe and wtass.exe with install parameters, or the creation of a Windows service associated with these filenames using sc.exe. This activity is indicative of service-based persistence or malicious software installation.
Detects an authentication event followed by a computer account change event (Event ID 4742) targeting a domain controller computer account. This pattern may indicate unauthorized modifications to domain controller machine accounts, which is often associated with persistence or privilege escalation attempts.
This rule detects file creation or modification events within the WordPress plugin directory for 'admin-menu-editor-pro'. Given that WordPress plugins are frequent targets for web shell placement, this rule monitors for unauthorized changes to the plugin's file structure, which may indicate an attempt to gain persistence or remote code execution on the web server.
Detects file-related operations (creation, modification, renaming, or deletion) performed on files containing 'acronis' or 'backup' in their path, executed by a process associated with Acronis, running under highly privileged system contexts (root or SYSTEM). This activity is indicative of potential unauthorized manipulation or disabling of backup software, commonly seen in ransomware attacks to inhibit recovery.
This rule identifies successful network connections from local devices to a predefined list of known malicious IP addresses within the last 7 days. Such connections often indicate active communication between a compromised endpoint and adversary-controlled infrastructure.
Detects potential installation of compromised Admin Menu Editor Pro plugin updates by identifying sequential download events for specific plugin versions from the 'adminmenueditor.com' domain within a 24-hour window. This behavior is indicative of a supply chain attack where a legitimate update mechanism is leveraged to deliver malicious payloads without integrity verification.
Detects the registration of browser service workers from suspicious sources. Service workers can be used to maintain persistence, intercept network requests, or perform browser-based man-in-the-middle attacks. This rule specifically alerts on service workers initialized with 'blob:' URIs or those originating from the suspicious 'cdn.bloom.io' domain.
Detects DNS resolution requests for the domain 'myaccount.microsoft.com', which is the Microsoft account management portal. This activity is often associated with legitimate user authentication or account configuration processes, but can be used as part of reconnaissance or credential-related activities.
Detects DNS resolution attempts for graph.microsoft.com by processes other than standard web browsers or mail clients. This activity is indicative of scripted tools or malicious software attempting to enumerate or access Microsoft 365 mailbox content via the Graph API, bypassing normal user interaction.
Detects the creation or modification of a scheduled task named 'Maps Performance Task' using schtasks.exe or reg.exe. This task is often associated with legitimate Windows system maintenance related to map data but may be monitored as it involves persistence mechanisms.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
This rule identifies critical or high-severity software vulnerabilities affecting devices tagged as part of a PCI-CDE (Payment Card Industry Cardholder Data Environment) scope. It summarizes the findings by CVE, severity level, count of affected devices, and specific assets involved, prioritizing remediation for PCI compliance.
Detects instances where processes associated with AutoIt scripting (e.g., AutoIt-based compiled executables or scripts) initiate suspicious API calls including CreateRemoteThread, OpenProcess, or generic ProcessInjection against known target binaries such as RegSvcs.exe or mobsync.exe. These binaries are frequently abused for proxy execution or living-off-the-land techniques to hide malicious activity.
Page 390 of 1908