Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects the execution of known credential dumping tools, Mimikatz and ProcDump, when specific command-line arguments associated with credential extraction from LSASS are used. It specifically looks for `mimikatz.exe` or `procdump.exe` combined with arguments like `sekurlsa`, `logonpasswords`, or `-ma` which are commonly used to dump credentials from memory.
This rule detects the creation of a scheduled task named 'MicrosoftSystem64' using various methods. It looks for command-line execution of 'schtasks.exe /create' with the specific task name, explicit ScheduledTaskCreated events from Microsoft Defender for Endpoint (MDE) containing 'MicrosoftSystem64', and Windows Security Event ID 4698 (Scheduled Task Created) where the TaskName contains 'MicrosoftSystem64'. This specific task name is associated with known threat actor activity, particularly FAMOUS CHOLLIMA / DPRK-linked actors deploying Node.js SEA RAT.
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
This rule detects the creation of suspicious child processes by Microsoft Office applications. This behavior is commonly associated with malicious macros embedded in Office documents or phishing attacks that leverage Office documents to execute arbitrary commands. The rule specifically looks for Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Publisher, Visio, Access) spawning known suspicious executables like command prompts, PowerShell, script interpreters (wscript, cscript), and various utility tools (mshta, regsvr32, rundll32, certutil, bitsadmin, wmic, schtasks, whoami, net, netsh, nslookup, curl).
Detects the creation of specific Payouts King ransomware artifacts, including its ransom note ('readme_locker.txt') and known encrypted file extensions ('.ZWIAAW') or temporary backup file extensions ('.esVnyj'). This rule focuses on file creation events indicative of a Payouts King ransomware infection.
Identifies the creation, execution, or deletion of specific scheduled tasks ('\Mozilla\ElevateTask' or '\Mozilla\UpdateTask') used by Payouts King ransomware for persistence and SYSTEM elevation.
Detects creation or manipulation of the ROTATE subdirectory within the Skylight Metrics Agent path by non-SYSTEM accounts. CVE-2026-7791 exploitation requires replacing the legitimate ROTATE directory with a junction point targeting the attacker's desired write location. The Skylight service then follows the junction during its log rotation, writing attacker-controlled files to the target with SYSTEM privileges. Any non-SYSTEM interaction with this specific path warrants investigation.
This rule detects the use of specific command-line flags in Google Chrome processes that are associated with the FlutterShell backdoor. These flags, '--hide-crash-restore-bubble' and '--disable-session-crashed-bubble', are used by FlutterShell to suppress crash warnings after forcing a restart, indicating an attempt to evade detection or maintain persistence.
Detects the creation of the 'TieringEngineService.exe' bait file within a specific RedSun temporary directory pattern (RS-{GUID}) associated with the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to exploit Windows Defender.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
This rule detects potential vulnerability scanning activity by identifying multiple network connection attempts to common vulnerable ports (135, 139, 445) where the remote URL contains keywords like 'vuln' or 'scan'. It aggregates these activities by device and time, flagging devices with 5 or more such connections within an hour.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
Detects devices making a high volume (5 or more per hour) of successful network connections to remote URLs containing 'update' or 'patch' on port 443 (HTTPS). This could indicate legitimate system updates, but also potentially malicious update checks or beaconing activity.
Identifies node.js or npm processes attempting to access known credential stores or execute credential dumping utilities, which may indicate the presence of the Miasma credential-stealing worm.
Detects attempts to read common HashiCorp Vault token paths from the filesystem, indicating potential credential harvesting by malware like Miasma stealer.
Detects the creation of archive files (zip, rar, 7z, tar.gz) by processes other than common archiving utilities. This could indicate data staging or preparation for exfiltration by an adversary.
This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.
Detects when a browser navigates to or launches with a 'blob:https://' URL. This can indicate unusual browser activity, potentially related to data exfiltration, web-based attacks, or specific application behaviors that might warrant investigation.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
This rule detects suspicious DLL side-loading activity. It looks for DLL files being loaded from common user-writable or temporary directories (like `\temp\` or `\users\`) by legitimate Windows processes such as `rundll32.exe`, `explorer.exe`, or `svchost.exe`. The rule specifically flags instances where a DLL is loaded more than 3 times within an hour by these processes, indicating potential malicious activity where an adversary might be attempting to execute their own malicious DLLs by hijacking the loading process of a legitimate application.
This rule detects potential ransomware activity by identifying a high volume of file encryption events. It looks for files being renamed or created with common ransomware-related extensions such as '.locked', '.crypt', '.encrypted', '.enc', or a generic pattern of a 6 or more character alphanumeric extension. The rule then counts these events within one-hour bins and alerts if more than 20 such files are detected in a single folder path.
Page 430 of 509