Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,680 detections
Filters
Last updated
All Time
Detection languages
10,196
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,285
2,978
2,238
1,835
1,458
Platforms
10,391
1,109
809
155
98
Products / Services
10,680
9,759
6,693
4,421
3,750
MITRE Techniques
3,819
3,134
1,801
1,572
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects an unusually high volume of file deletion events on a device within a short time frame (100 or more files deleted within a 5-minute window). This activity can be indicative of malicious behaviors such as ransomware encrypting and deleting original files, data wiping attacks, or an adversary attempting to remove forensic evidence by deleting logs or other critical files.
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
This rule detects when a single account initiates 5 or more successful Remote Desktop Protocol (RDP) connections within a one-hour window. This behavior can be indicative of an adversary attempting to gain widespread access within a network, potentially through credential stuffing, brute-force attacks, or lateral movement using compromised credentials.
This rule detects potential vulnerability scanning activity by identifying multiple network connection attempts to common vulnerable ports (135, 139, 445) where the remote URL contains keywords like 'vuln' or 'scan'. It aggregates these activities by device and time, flagging devices with 5 or more such connections within an hour.
Detects exploitation of weak service file permissions for privilege escalation
Detects use of CreateProcessWithTokenW for spawning elevated processes
Detects autorun.inf files written to removable media for self-propagation
Detects remote service connections originating from external internet addresses
Detects use of stolen legitimate code signing certificates on suspicious binaries
Detects modification of Linux RC initialization scripts for persistent execution
Detects Office documents fetching remote templates for template injection attacks
Detects CONNECT tunneling via compromised VPS servers used as proxy relay
Detects parent process ID spoofing used to hide malicious process relationships
Detects registry modifications designed to disable automatic system reboots and scheduled maintenance, preventing the system from interrupting destructive actions, as observed with BLUERABBIT.
Detects port knocking sequences used to activate hidden network backdoors
Detects Dynamic Data Exchange formula injection in Office documents for code execution
Detects download of tools designed to bypass Windows trust control mechanisms
Detects sustained high-rate web access used to determine business operating hours
Detects SVG files embedding base64 executables for HTML smuggling
Detects system scripts like PubPrn used as execution proxies for defense evasion
Page 417 of 509