Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects host-based activity or network communication associated with the SloppyRAT remote access trojan. The rule monitors for specific malicious file hashes and connection attempts to known C2 IP addresses and domains.
Detects the execution of the Windows Event Utility (wevtutil.exe) with the 'cl' (clear-log) command, specifically targeting multiple critical event logs simultaneously. This behavior is indicative of anti-forensic activity aimed at obfuscating post-compromise actions, as seen in the Settra ransomware campaign.
Detects Git checkout operations executed by AI coding agent processes that specify a full 40-character commit hash or use 'FETCH_HEAD'. This behavior is indicative of potential supply chain attacks, specifically the 'Plugin4Shell' vulnerability, where malicious actors attempt to force the agent to checkout arbitrary, potentially malicious, repository references.
Detects Git commands initiated by AI coding agent processes that perform a checkout of a specific 40-character SHA hash or a FETCH_HEAD reference. This behavior is potentially indicative of a supply chain attack where an AI plugin agent is being instructed to swap code components or load specific, potentially malicious, commit versions from a remote repository.
Detects .NET malicious payloads associated with the StealC info-stealer by identifying anti-debugging and anti-analysis routines. The rule specifically looks for the usage of System.Diagnostics.Debugger methods (IsAttached, IsLogging), native debugger presence checks (IsDebuggerPresent, CheckRemoteDebuggerPresent), and Environment.FailFast usage, often in combination with obfuscation markers like ConfuserEx.
Detects PowerShell processes executing [Reflection.Assembly]::Load to load .NET assemblies directly into memory. This behavior is commonly used by fileless loaders such as StealC to execute malicious payloads while avoiding disk-based artifacts.
Detects instances of PowerShell executing process injection techniques (such as memory allocation and remote thread creation) targeting specific legitimate processes including csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is indicative of the StealC malware attempting to masquerade its malicious code execution within trusted system or browser processes.
Detects malicious PowerShell activity using the -ExecutionPolicy Bypass flag combined with caret obfuscation or indicators related to known malicious infrastructure used in ClickFix-style social engineering campaigns. The rule specifically monitors for attempts to download or execute configuration.ps1 from identified attacker domains and IP addresses.
Detects the execution or deployment of MeshAgent, a legitimate Remote Monitoring and Management (RMM) tool, which is often abused by adversaries to maintain persistence and command-and-control access. The rule monitors for common process names such as meshagent.exe and mvtcs.exe, as well as command-line arguments containing 'meshagent'.
Detects unauthorized processes attempting to read browser-stored sensitive files, such as 'Login Data' (credentials) and 'Cookies' (session tokens) for Google Chrome and Microsoft Edge. This activity is a common indicator of credential dumping by information stealers like StealC.
Detects the execution of reagentc.exe with the /disable flag, which is used to disable the Windows Recovery Environment (WinRE). This activity is often performed by ransomware actors prior to data encryption to prevent system recovery and hinder incident response.
Detects a successful VPN authentication event followed within 30 minutes by the execution of the MeshAgent RMM tool or its renamed variant mvtcs.exe. This behavioral pattern is associated with initial access via compromised VPN credentials followed by the deployment of remote monitoring and management (RMM) tools for persistence and command and control.
Detects a suspicious sequence of system utility executions (reagentc.exe, diskpart.exe, ipconfig.exe, and cipher.exe) originating from a single parent process within a 10-minute window. This behavior is indicative of ransomware attempting to inhibit system recovery and perform anti-forensic actions.
Detects instances where AI coding agents (such as Claude Code, Copilot, etc.) execute git commands (checkout, fetch, clone) using a branch name or reference formatted as a 40-character hex string. This behavior is indicative of a 'Plugin4Shell' style bypass, where an attacker crafts a branch name that mimics a commit SHA to cause ambiguous refname errors or hijack repository operations.
Detects the loading or presence of the vulnerable GIGABYTE driver (gdrv.sys), which is frequently exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level access and disable security products. The rule monitors for file artifacts and service creation/execution commands associated with this driver.
Detects Settra ransomware binaries for Windows by identifying specific file naming conventions ('_win64.exe'), ransom note filenames, encrypted file extensions, and target directory paths embedded within the binary.
Detects the execution of MeshAgent, a remote monitoring and management (RMM) tool, by monitoring for its associated process names (meshagent.exe, mvtcs.exe) or command lines containing the string 'MeshAgent'. Adversaries often abuse such legitimate remote access tools to establish persistent command and control channels or to perform unauthorized administrative activities.
Detects the presence of references to the gdrv.sys driver within files or command-line strings. The gdrv.sys driver is a known vulnerable driver frequently exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode privileges and disable endpoint security products.
Detects unauthorized processes attempting to access sensitive browser files, specifically 'Login Data' (credentials) and 'Network/Cookies' databases for Google Chrome and Microsoft Edge. Legitimate browser processes and update services are explicitly excluded.
Detects the use of the wevtutil.exe utility to clear specific Windows Event Logs. Adversaries may clear event logs to hide evidence of malicious activity on a system.
Detects the creation of files with specific extensions (.locked, .locked_wip) or filenames (RESTORE_FILES.txt) commonly associated with ransomware operations and ransom notes.
Page 394 of 1908