Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,324
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to JeetBot/Twitch Enhanced Viewer malicious browser extension infrastructure exfiltrating Twitch OAuth tokens. Apex domains (jeetbot.cc, api.jeetbot.cc) are gated on a token-forwarding indicator to avoid false positives.
This rule monitors for indicators of compromise (IOCs) associated with a specific AutoIT-based malware delivery chain. It tracks the execution and presence of specific malicious file names and SHA256 hashes, as well as network connections to a identified command-and-control (C2) infrastructure IP address (158.51.122.136). The detection spans file creation, process execution, image loading, and network communication events to identify the multi-stage attack lifecycle.
This rule monitors for indicators of compromise (IOCs) associated with a specific AutoIT-based malware delivery chain. It tracks the execution and presence of specific malicious file names and SHA256 hashes, as well as network connections to a identified command-and-control (C2) infrastructure IP address (158.51.122.136). The detection spans file creation, process execution, image loading, and network communication events to identify the multi-stage attack lifecycle.
Detects network connections from common web browsers to domains associated with the BragJack threat actor infrastructure. This activity potentially indicates an end-user accessing malicious sites used for credential harvesting, malware delivery, or C2 communication.
Detects instances where a browser process (chrome.exe) accesses the microphone or camera within a 2-minute temporal window of communicating with 'gemini.google.com'. This rule is intended to identify potential unauthorized use of system peripherals in the context of an AI-agent session.
Detects instances where a browser process (chrome.exe) accesses the microphone or camera within a 2-minute temporal window of communicating with 'gemini.google.com'. This rule is intended to identify potential unauthorized use of system peripherals in the context of an AI-agent session.
Detects the 'Comet.exe' process, associated with the Perplexity Comet AI agent, accessing sensitive system files or configuration directories outside its expected scope. This pattern of file interaction is characteristic of unauthorized data collection or exfiltration attempts, specifically linked to the BragJack threat activity.
Detects the 'Comet.exe' process, associated with the Perplexity Comet AI agent, accessing sensitive system files or configuration directories outside its expected scope. This pattern of file interaction is characteristic of unauthorized data collection or exfiltration attempts, specifically linked to the BragJack threat activity.
Detects instances where browser processes (chrome.exe or comet.exe) create multiple screenshot-related files in quick succession without apparent user interaction, a behavior pattern observed in the BragJack attack chain associated with hijacked browser AI agents.
This rule detects network communication, email interaction, or identity logon events related to known spoofed IC3 (Internet Crime Complaint Center) domains used in business email compromise (BEC) campaigns. The detection covers multiple telemetry sources including email URL information, device network events, and identity logon logs to identify attempts to interact with fraudulent portals.
Detects the execution of PowerShell or PWSH with command-line arguments often used to obfuscate scripts or hide activity, such as encoded commands (-enc), base64 decoding, or running the process with a hidden window.
This rule detects network communication, email interaction, or identity logon events related to known spoofed IC3 (Internet Crime Complaint Center) domains used in business email compromise (BEC) campaigns. The detection covers multiple telemetry sources including email URL information, device network events, and identity logon logs to identify attempts to interact with fraudulent portals.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
Detects the loading or execution of 'core.dll' from non-standard system directories by common Windows proxy execution binaries (rundll32.exe, regsvr32.exe, cmd.exe, powershell.exe), which is a common indicator of DLL side-loading or malicious library hijacking.
This rule detects attempts by users to disable or clear command line history logs for shell environments, including PowerShell (e.g., modifying PSReadLine history) and Unix-like shells (e.g., unset HISTFILE, setting HISTSIZE to 0, or disabling history collection). Such actions are frequently performed by adversaries to hinder incident response and forensic analysis by obscuring their post-exploitation activity.
Detects the creation, modification, or renaming of unsigned executable files (.exe, .dll, .sys, .efi) within critical Windows system directories (System32, SysWOW64, drivers, boot). The rule excludes activity triggered by known trusted OS update processes, such as TrustedInstaller or Windows Update services, and optionally flags occurrences outside defined maintenance windows.
This rule detects attempts to modify file or directory permissions (e.g., using icacls, takeown, chmod, or chown) on paths associated with known security products. Such activity is often indicative of an adversary attempting to tamper with, disable, or exclude security tools from logging or inspection.
This rule detects potentially malicious activity involving the modification of Excel macro security settings (specifically VBAWarnings or AccessVBOM) or the creation of autorun.inf files on removable drives. It identifies these behaviors when they coincide with the execution of Synaptics.exe within a 30-minute window, suggesting a potential correlation between local administrative tasks and malicious document-based payloads or portable drive staging.
Page 416 of 1908