Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
This detection helps you spot activity linked to TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8) using the specific indicators in the linked source. It is written to be high confidence by focusing on exact versions, domains, paths, or file fingerprints that were observed in the reporting. A match does not prove a system is compromised by itself, but it is a strong reason to investigate. Confirm the affected host and user, check whether the access was expected, and review nearby activity for follow-on steps like additional downloads, new persistence, or repeated connections. Use the source link to support incident.
Detects PowerShell being copied and renamed to 'wt.exe' in the ProgramData directory, initiated by cmd.exe, powershell.exe, or pwsh.exe, and executing a command line containing '-curl'. This behavior has been documented in the Axios npm supply chain attack.
This rule detects network connections from devices to known malicious infrastructure, specifically the domain 'sfrclak.com' or the IP address '142.11.206.73'. These indicators are associated with potential compromise or command and control activity.
Detects multiple activities associated with the CTRL framework, including hiding user accounts, persistence via scheduled tasks, UAC bypass using wlrmdr.exe, RDP shadow session hijacking, VPN disconnects via rasdial, and RDP restriction loosening.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects suspicious activity where a non-browser process attempts to decrypt credentials stored by Google Chrome or Microsoft Edge using DPAPI (Data Protection API). This could indicate an adversary attempting to steal stored browser credentials.
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
KQL Query
Detects suspicious execution of rundll32.exe initiated by explorer.exe that includes network-related command-line arguments (http, https, .dll, entrypoint). This pattern can indicate malicious DLL loading or execution attempting to establish network communication, potentially for command and control or data exfiltration. The rule filters out common system accounts and focuses on infrequent occurrences.
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
This rule detects various indicators of compromise associated with the GlassWorm malware. It monitors for network connections to known GlassWorm remote IPs and domains, process activity involving specific GlassWorm filenames, folder paths, command line arguments (including wallet addresses and command terms), and registry modifications for persistence (Run/RunOnce keys with GlassWorm-related values). The rule correlates multiple evidence types to reduce false positives.
Detects the initial CTRL execution chain where a malicious LNK launches hidden PowerShell, writes ms-settings UAC bypass registry keys including DelegateExecute, then starts fodhelper.exe. This rule correlates process events for PowerShell executing with a hidden window style and obfuscated commands, registry modifications to the ms-settings UAC bypass key, and the subsequent execution of fodhelper.exe.
Detects instances where rundll32.exe is launched by explorer.exe and includes command-line parameters indicative of network communication (http, https) or WebDAV activity (davclnt.dll, WebDAV, \\). This behavior can be associated with forced authentication attempts or execution of remote code.
Detects suspicious execution of PowerShell or MSHTA with encoded commands or web content from common user-facing applications like Explorer, Word, or Outlook. This pattern is often indicative of initial access or execution techniques used by adversaries.
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
AI is becoming a key part of detection and response, but it’s important not to overlook simpler techniques that are still effective.
In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed.
The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed.
The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
Detects instances where dllhost.exe initiates outbound network connections to public IP addresses. Legitimate dllhost.exe processes rarely need to communicate with the internet. Such connections could indicate compromise through COM object hijacking, process hollowing, or injected code attempting to establish command and control (C2) communication.
Page 439 of 509