Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
This rule detects suspicious activity related to browser extension installations by monitoring registry modifications. Specifically, it looks for multiple registry value sets within Chrome or Firefox extension paths within a short timeframe (1 hour), which could indicate an automated or malicious installation of browser extensions.
This rule watches for AI-named programs run straight from the Downloads folder or temporary directories after a web download. Many fake AI scams start exactly this way. If the program then does anything unusual, it may be malware posing as a free AI tool. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects potential DNS exfiltration attempts by monitoring DNS query responses for specific keywords ('exfil', 'data', 'c2') in the remote DNS name. It flags devices that make 20 or more such suspicious DNS queries within an hour, indicating a high volume of potentially malicious DNS activity often associated with DNS tunneling or data exfiltration.
This rule finds an npm package whose main index.js file was swapped for a much larger obfuscated version. Maintainers may not notice a silent replace during a compromise. Compare package hashes to known good releases. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects anomalous network communication patterns that might indicate Command and Control (C2) activity. It identifies devices making at least 5 connections within a 10-minute window to common web/HTTPS ports (443, 8443, 8080) where the initiating process is not a standard web browser (chrome.exe, firefox.exe, iexplore.exe, msedge.exe). This pattern can suggest non-browser applications establishing frequent connections to C2 servers.
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
This rule detects devices making a high volume of DNS queries (50 or more within a 5-minute window) to domains that have 4 or more subdomains and are not common legitimate services like microsoft.com, google.com, or amazon.com. This pattern can be indicative of DNS beaconing, a technique used by adversaries for command and control (C2) communication or data exfiltration.
This rule detects when two or more files with suspicious names (e.g., 'update.exe', 'temp.exe', 'setup.exe') are created within a short timeframe (1 hour) in common user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. This pattern can indicate the dropping of malicious payloads or staging of files by an adversary.
This rule detects successful network connections to remote URLs associated with AlphV/BlackCat ransomware, including payment sites. It specifically looks for 'alphv', 'blackcat', 'noname', or 'ransom-payment' within the RemoteUrl field of DeviceNetworkEvents.
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
Detects the creation of files with names commonly associated with LockBit ransomware, such as '.lockbit', 'lockbit_note', or '.abcd'. This rule specifically looks for these file names being created on devices, which is indicative of ransomware activity.
This rule detects network connections initiated by the 'teams.exe' process to public IP addresses. It specifically looks for outbound connections from the Microsoft Teams application to external, non-private IP ranges. This could be used to monitor unusual external communication patterns from Teams, although the specific intent without further context is unclear.
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Detects network connections to specific API endpoints used by the HarborWatch Agent for Command and Control (C2) communication. This rule helps identify active C2 beaconing and tasking, even if the underlying IP infrastructure changes, by monitoring for unique URI paths like '/api/agent/tasks/' and '/api/heartbeat'.
Identifies the creation of PowerShell or batch files in unusual ProgramData subdirectories by command-line interpreters, which may indicate malware staging or persistence preparation.
Detects excessive caret (^) escaping in command lines, a common obfuscation technique used by attackers to evade detection and conceal malicious commands. The rule specifically looks for command-line executions by cmd.exe, powershell.exe, or pwsh.exe that contain more than 5 caret characters and a pattern of at least three alphanumeric characters immediately followed by a caret.
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
Detects COR_PROFILER environment variable abuse for .NET DLL hijacking
Page 412 of 509