Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects common PowerShell patterns used for downloading content from the internet and then executing it. It looks for a combination of download-related commands/objects (e.g., DownloadString, Invoke-WebRequest, Net.WebClient) and execution-related commands/objects (e.g., IEX, Invoke-Expression, Invoke-Command, ScriptBlock) within PowerShell command-line activity. This behavior is frequently observed in malware and adversary tradecraft for initial access, execution, and persistence.
This rule detects PowerShell commands indicative of reflective code loading, specifically looking for the use of 'Assembly' and 'Load' or 'GetType' and 'Invoke' within PowerShell command arguments. It filters out common noise associated with legitimate PowerShell operations like PSGet, Cursor, and internal Microsoft PowerShell modules to reduce false positives.
Detects the creation or modification of a specific scheduled task containing the string "M1onltor". This is an artifact of SHADOW-EARTH-053 establishing continuous persistence for their side-loaded malware loaders.
Detects creation or modification of the SafeBoot\Network\Remote Access Service registry key, a persistence mechanism used by the STAC6405 (VENOMOUS#HELPER) campaign. This ensures the SimpleHelp-based RAT survives Safe Mode with Networking reboots, which is a common remediation step for defenders. The specific 'Remote Access Service' subkey under SafeBoot\Network is a static Indicator of Compromise (IOC) for this campaign, as modifications to SafeBoot\Network are generally rare in benign Windows operations.
Detects the execution of binaries hidden in the C:\ProgramData directory with a .log extension matching a specific random pattern used by threat actors. This technique is often used for defense evasion and masquerading.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects when a browser navigates to or launches with a 'blob:https://' URL. This can indicate unusual browser activity, potentially related to data exfiltration, web-based attacks, or specific application behaviors that might warrant investigation.
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.
Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.
Identifies potential network tunneling, proxying, and reverse shell activities by correlating process creation with outbound public network connections. This rule looks for known tunneling and proxy tool filenames and specific command-line arguments indicative of such activities, then correlates these process events with successful or attempted outbound network connections to public IP addresses.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
Detects process executions where the command line contains an HTTP/HTTPS URL with an explicit IPv4 address instead of a domain name. This technique is often used by malware and downloaders to fetch payloads or communicate with C2 servers while bypassing DNS.
This rule detects the execution of processes with filenames starting with 'claude' on server devices. It specifically targets server endpoints by filtering device information to include only 'Server' device types and then joins this with process execution events. This could indicate the presence or execution of AI-related tools or unauthorized software on critical infrastructure.
This rule detects network connections from devices to a predefined list of domains commonly associated with data exfiltration services. Monitoring these connections can help identify attempts to transfer sensitive data out of the network.
Detects successful network connections over FTP (port 21) or SSH (port 22) initiated by common file transfer applications such as WinSCP, FileZilla, psftp, or scp. This activity could indicate data exfiltration, unauthorized access, or command and control.
This rule detects suspicious or malicious use of mshta.exe. It flags executions where mshta.exe is not launched from standard system directories (C:\Windows\System32 or C:\Windows\SysWOW64), or when its command line contains indicators of remote or script execution (e.g., URLs, .hta, .js, .vbs extensions, javascript:, vbscript:). Additionally, it identifies suspicious parent processes that initiate mshta.exe, such as command shells (cmd.exe, powershell.exe), script hosts (wscript.exe, cscript.exe), installers (msiexec.exe), or common Microsoft Office applications (winword.exe, excel.exe).
Detects Windows Explorer (explorer.exe) initiating outbound network connections over port 445 (SMB) to non-private, external IP addresses. This behavior aligns with the zero-click authentication coercion vulnerability (CVE-2026-32202) where Explorer automatically reaches out to a remote UNC path to fetch an icon resource, leaking NTLM hashes.
Identifies when Microsoft Defender for Endpoint blocks or quarantines a file, extracting the malicious SHA256 hash. This rule specifically looks for `DeviceEvents` and `DeviceFileEvents` where an action type indicates a block or quarantine, and then extracts additional details like `ThreatName` and `AvAction` to confirm the successful intervention. It also includes an exclusion list for known benign hashes like EICAR.
Page 436 of 509