Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,759
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
This rule detects suspicious activity related to browser extension installations by monitoring registry modifications. Specifically, it looks for multiple registry value sets within Chrome or Firefox extension paths within a short timeframe (1 hour), which could indicate an automated or malicious installation of browser extensions.
This rule detects installers masquerading as legitimate security or analysis utilities (e.g., Ghidra, dnSpy, Wireshark) that subsequently launch common loader programs (e.g., PowerShell, rundll32, cmd.exe). Such activity often indicates an attempt to bypass user suspicion and deliver malware. It is crucial to verify publisher signatures and the origin of downloaded software. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
This rule detects potential ransomware activity by monitoring for a high volume of file creation or renaming events where the new file names end with common ransomware extensions such as '.encrypted', '.locked', or '.crypted'. It aggregates these events over 5-minute intervals and triggers if 50 or more such files are observed on a single device.
This rule detects a high volume of outbound network connections (20 or more within an hour) from a single device and process to non-RFC1918 IP addresses on ports commonly associated with Remote Access Trojans (RATs) or Command and Control (C2) communication. The ports monitored include 443, 8443, 8080, 80, 4444, 5555, 6666, and 7777. This pattern can indicate a compromised host attempting to establish C2 with an external adversary.
Detects network connections to the '.cfd' TLD originating from common web browsers. This cheap TLD is increasingly abused by attackers to host phishing redirect pages delivered via malicious SVG files.
Detects generic application layer protocol abuse for C2 communications
Detects enumeration of USB devices for peripheral device discovery
Detects download of malware builder or generator tools from code repositories
Detects executables signed with self-signed code certificates for trust bypass
Detects junk data padding in HTTP requests used to obfuscate C2 communications
Detects access to platforms selling zero-day vulnerability intelligence
Detects XOR-encrypted payload delivery used to evade signature detection
Detects stripped executable payloads with debug information removed for evasion
Detects IP geolocation lookups used to determine system geographic location
Detects access to credential files through web shell commands
Detects POST requests to pages matching credential harvesting patterns
Detects credential stuffing attacks targeting account takeover for infrastructure abuse
Detects automated social media account registration used for fake identity infrastructure
This rule detects the creation of a specific mutex pattern associated with the Grixba ransomware. The mutex name starts with 'CPFATE_' and contains the .NET framework version string 'v4.0.30319', which is a unique artifact used by Grixba to ensure only one instance of itself is running.
Detects attempts by the Grixba ransomware to query a specific custom locale registry key (en-US) for geofencing purposes. This activity is indicative of the ransomware checking the system's locale settings, potentially to avoid encrypting systems in certain geographical regions.
Page 422 of 509