Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,324
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the reflective loading of .NET assemblies into memory using APIs like Assembly.Load or Reflection.Emit, where no corresponding DLL file is written to the disk. This technique is often used by malware (such as the Stella_Gary backdoor) to execute code in a fileless manner and evade disk-based security detections.
This rule detects files that feature a valid RTF file header (literal '{' followed by 'rtf1') at the start of the file, but lack standard RTF control words such as \ansi or \fonttbl. The presence of executable content, PowerShell commands, or script markers within these files indicates a file-type masquerading technique used to bypass security controls by disguising malicious payloads as RTF documents.
This rule detects the presence of the unsigned 'OrionQuests-Setup.exe' file, which is a deceptive .NET installer associated with the Kimsuky (APT-C-55) threat actor, used to distribute the Stella_Gary backdoor. The rule looks for specific strings associated with .NET binaries and shortcut (LNK) file interaction, while excluding signed executables to reduce noise.
This rule detects the creation of scheduled tasks that attempt to masquerade as legitimate Google Chrome Update tasks. It flags tasks that use the 'Google Chrome Update' name but do not follow the standard naming convention (which typically includes 'GoogleUpdateTaskMachine') or tasks that initiate suspicious actions using scripting engines (like PowerShell, cmd.exe, mshta, etc.) rather than the signed Google update binary.
Detects the execution or creation of files masquerading as Mozilla Firefox components (e.g., firefox.exe) located within non-standard, suspicious directories under 'ProgramData'. The rule further refines these alerts by identifying instances where the file lacks a valid Mozilla digital signature or contains an incorrect company name in its metadata.
Detects instances where a process named firefox.exe attempts to establish persistence via Windows Registry Run keys or Windows Task Scheduler while operating outside of standard Mozilla Firefox installation directories. This behavior is indicative of masquerading techniques used by threats such as BabylonRAT to maintain persistence under the guise of a common web browser.
Detects unauthorized access to sensitive browser credential files (e.g., Chrome 'Login Data', Firefox 'logins.json' and 'key4.db') by processes other than legitimate browser executables. This behavior is indicative of credential harvesting attacks, such as those performed by BabylonRAT.
Detects instances where a process masquerading as Firefox (executing outside of legitimate program directories) attempts to modify the Windows 'hosts' file. This behavior is indicative of BabylonRAT or similar malware attempting to redirect network traffic to malicious domains by tampering with local DNS resolution.
Detects instances where a process masquerading as Firefox (executing outside of legitimate program directories) attempts to modify the Windows 'hosts' file. This behavior is indicative of BabylonRAT or similar malware attempting to redirect network traffic to malicious domains by tampering with local DNS resolution.
Detects potential keylogging behavior by identifying a process masquerading as firefox.exe that is operating from an unauthorized directory while utilizing keyboard hooking (SetWindowsHookEx) or polling (GetAsyncKeyState) APIs, a technique consistent with the BabylonRAT malware.
Detects the use of PowerShell to load .NET assemblies into memory using the Assembly.Load method. This technique is often employed by adversaries to execute malicious payloads reflectively, avoiding the creation of files on disk.
Detects when a user who has successfully authenticated to a system is subsequently added to the 'Domain Admins' group within a 15-minute window. This behavior often indicates an adversary performing privilege escalation after gaining initial access to an account.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects the Stella_Gary .NET backdoor loader used by Kimsuky/APT-C-55, identified by managed-layer reflective assembly loading strings (loader.Program.Main, AssemblyResolve callback, Stella_Gary.Program.Main)
Detects instances where an Azure AD Connect or MSOL synchronization account performs directory replication actions (DS-Replication-Get-Changes) from a host or at a time inconsistent with its 14-day established baseline. The rule further correlates these anomalies with Azure Audit logs or AzureActivity entries associated with the identity to identify potential cloud-originated abuse or credential compromise.
Detects anomalous network traffic patterns characterized by rapid domain rotation, where multiple distinct domains resolve to a known set of IronToll C2 infrastructure IP addresses within a short timeframe (48 hours). Added an explicit 2-day lookback window — the original query had no time bound at all, so every scheduled run re-scanned the table's entire retention period and would keep re-surfacing the same historical match indefinitely instead of only genuinely recent activity.
Detects anomalous network traffic patterns characterized by rapid domain rotation, where multiple distinct domains resolve to a known set of IronToll C2 infrastructure IP addresses within a short timeframe (48 hours). Added an explicit 2-day lookback window — the original query had no time bound at all, so every scheduled run re-scanned the table's entire retention period and would keep re-surfacing the same historical match indefinitely instead of only genuinely recent activity.
Detects anomalous network traffic patterns characterized by rapid domain rotation, where multiple distinct domains resolve to a known set of IronToll C2 infrastructure IP addresses within a short timeframe (48 hours). Added an explicit 2-day lookback window — the original query had no time bound at all, so every scheduled run re-scanned the table's entire retention period and would keep re-surfacing the same historical match indefinitely instead of only genuinely recent activity.
This rule monitors DeviceNetworkEvents for outbound connections to a list of known malicious or suspicious IP addresses. This activity is indicative of potential command and control (C2) communication or unauthorized data exfiltration.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
Detects several potentially malicious activities related to Active Directory Certificate Services (AD CS). This includes high volumes of failed requests (potential enumeration), requests for sensitive templates (privilege escalation), and potential impersonation attempts using Subject Alternative Names (SANs). These activities are associated with AD CS abuse techniques.
Page 408 of 1908