Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects in-memory archive creation using .NET compression libraries
Detects processes launched with hidden window to avoid user detection
Detects SyncAppvPublishingServer used for PowerShell proxy execution
Detects exploitation of weak installer file permissions
Detects high-volume POST requests to login forms indicating credential harvesting
Detects malware checking for user activity to detect sandbox environments
Detects processes launched with hidden window to avoid user detection
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects legitimate software deployment tools used for remote execution
Detects downloads of CVE exploit proof-of-concept code
Detects exploitation of weak installer file permissions
Detects download of password wordlists or hash dumps for offline cracking
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
Detects ListPlanting injection using LVM_SORTITEMS and SendMessage API
Detects opening of macro-enabled Office documents potentially containing malware
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
This rule detects the execution of 'python.exe' from within common Chromium-based browser application directories (Google Chrome, Microsoft Edge, Brave Browser). This activity is highly suspicious as Python should not legitimately execute from these paths under normal circumstances. Threat actors, such as UNK_DeadDrop, have been observed using this technique to bypass application-bound encryption path validation and steal sensitive data like browser credentials. Detection of this behavior indicates potential malicious activity, including credential theft or other forms of evasion.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Page 414 of 509