Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects instances where the GlobalProtect VPN client executable spawns a Windows command shell (cmd.exe). This behavior is highly suspicious as a legitimate VPN client typically does not launch interactive shells, and this pattern has been associated with the execution of malicious payloads such as fake MSI installers.
Detects network requests to Google Sheets API containing specific markers (-tk- or val-) in the request body, indicative of potential command and control (C2) communication patterns often associated with malware payloads using Google Sheets for data exfiltration or command retrieval.
This rule detects network communication, email interaction, or identity logon events related to known spoofed IC3 (Internet Crime Complaint Center) domains used in business email compromise (BEC) campaigns. The detection covers multiple telemetry sources including email URL information, device network events, and identity logon logs to identify attempts to interact with fraudulent portals.
This rule detects a suspicious sequence of activities indicative of potential lateral movement and credential access. It identifies the execution of PsExec (PSEXESVC.exe) in conjunction with volume shadow copy manipulation (vssadmin, wmic, or diskshadow to create or delete shadow copies) within a 30-minute window. It further correlates this activity with potential lateral movement commands (e.g., net.exe, query.exe, nslookup.exe) to assess the severity of the incident.
This rule detects a suspicious sequence of activities indicative of potential lateral movement and credential access. It identifies the execution of PsExec (PSEXESVC.exe) in conjunction with volume shadow copy manipulation (vssadmin, wmic, or diskshadow to create or delete shadow copies) within a 30-minute window. It further correlates this activity with potential lateral movement commands (e.g., net.exe, query.exe, nslookup.exe) to assess the severity of the incident.
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that reference suspicious paths (AppData/Local or Roaming) or specific executables often associated with suspicious activity (Launcher.exe, GapiUpdate.exe) in conjunction with 'DeviceSetupManager'. Additionally, it includes a hash-based detection for a specific known malicious file artifact.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility that reference suspicious paths (AppData/Local or Roaming) or specific executables often associated with suspicious activity (Launcher.exe, GapiUpdate.exe) in conjunction with 'DeviceSetupManager'. Additionally, it includes a hash-based detection for a specific known malicious file artifact.
This rule monitors network, DNS, and email activity to identify communication or references to a set of known malicious domains associated with threat activity. It consolidates logs from device network events, DNS queries, and email telemetry (URLs and sender domains) to detect potential compromise or phishing attempts.
Detects access to sensitive credential stores (KeePass databases, Firefox logins, SSH keys, VPN configuration files) by suspicious processes, specifically those associated with potential credential harvesting tools or unauthorized update binaries.
This rule detects potential malicious activity by monitoring for specific file hashes, specific suspicious filenames, and suspicious command-line patterns (e.g., 'antivm') initiated by known update or launcher processes. This is likely an indicator of malware behavior involving anti-sandbox or evasion techniques.
This rule detects potential malicious activity by monitoring for specific file hashes, specific suspicious filenames, and suspicious command-line patterns (e.g., 'antivm') initiated by known update or launcher processes. This is likely an indicator of malware behavior involving anti-sandbox or evasion techniques.
Detects unauthorized processes attempting to access sensitive application data files such as browser cookies, local state, or data stored by applications like Discord, Telegram, and Steam, which are frequent targets for credential-stealing malware.
Detects unauthorized processes attempting to access sensitive application data files such as browser cookies, local state, or data stored by applications like Discord, Telegram, and Steam, which are frequent targets for credential-stealing malware.
This rule monitors network, DNS, and email activity to identify communication or references to a set of known malicious domains associated with threat activity. It consolidates logs from device network events, DNS queries, and email telemetry (URLs and sender domains) to detect potential compromise or phishing attempts.
Detects instances where AI-assisted development tools (Claude, Codex, Copilot, Gemini) are used to execute git checkout commands. The rule filters for non-interactive parent processes to identify potentially automated or background execution of git operations by these development assistants.
This rule detects potential automated cryptocurrency wallet draining activity by correlating the execution of known stealer processes (such as GapiUpdate or NeedleStealer) with subsequent outbound network connections to suspicious command-and-control domains or API endpoints within a 30-minute window.
This rule detects potential automated cryptocurrency wallet draining activity by correlating the execution of known stealer processes (such as GapiUpdate or NeedleStealer) with subsequent outbound network connections to suspicious command-and-control domains or API endpoints within a 30-minute window.
Page 399 of 1908