Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects the creation of DLL files in the `C:\Windows\System32` or `C:\Windows\SysWOW64` directories by processes that are not themselves located in these system directories. This behavior can indicate DLL planting, a technique used for persistence, privilege escalation, or defense evasion, often associated with DLL search order hijacking or side-loading. The rule excludes known legitimate activities such as printer driver installations and specific noisy legitimate software processes.
Detects the execution of 'SecurityHealthSetup.exe' from non-standard or suspicious directories such as 'Intel', 'Downloads', or 'Temp'. This executable is typically associated with Windows Security Health and should reside in system directories. Execution from other locations may indicate an attempt to masquerade malicious activity or defense evasion.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects the execution of multiple system reconnaissance commands concatenated into a single command line. This behavior is characteristic of the LAMEHUG malware, which uses LLMs to dynamically generate these command strings.
Detects network connections to known LLM/AI API endpoints from processes that are not standard web browsers. This is indicative of the LAMEHUG malware used by APT28, which leverages these APIs to dynamically generate and execute commands.
This rule detects the use of the 'makecab.exe' utility to compress the Active Directory database (ntds.dit) or the SYSTEM registry hive. This is a technique used by attackers to prepare credentials and system secrets for exfiltration, as observed in intrusions following FortiGate compromises.
This rule detects the presence of MicroStealer malware by matching known MD5, SHA1, or SHA256 hashes of its binaries against file events on monitored devices. MicroStealer is a credential stealer that targets various applications to exfiltrate sensitive information.
Detects known malicious invoice PDFs and email samples used in Crimson Kingsnake campaigns.
Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
This rule detects network connections to a specific Discord webhook URL and another suspicious domain (78smp.com/m/). This pattern is often associated with malware attempting to exfiltrate data or establish command and control (C2) via Discord webhooks, or other suspicious domains.
This rule detects the presence of files on endpoints that match a list of known malicious SHA256 hashes associated with the Nuso malware. It queries DeviceFileEvents to identify any file with a matching hash.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
This rule detects network connections to specific IP addresses and ports (1259, 1269) via UDP, or the presence of a file with a specific SHA256 hash. This combination could indicate command and control (C2) communication or data exfiltration using a custom UDP protocol.
Detects LampoRAT malware based on known file hash execution.
This rule detects network connections to a list of domains identified as associated with phishing activities associated with Crimson Kingsnake. Monitoring these connections can help identify compromised systems or users attempting to access malicious sites.
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
Detects the execution of files signed by "TrustConnect Software PTY LTD", a certificate issuer observed signing malware that impersonates legitimate workplace applications to deploy RMM backdoors. This rule identifies processes launched from binaries associated with this suspicious certificate.
Detects GhostBackdoor malware execution via known file hash.
This rule detects network connection events and Entra ID sign-in events originating from Iran. It aggregates these events hourly to identify potential suspicious activity from a geo-restricted or high-risk country.
Page 442 of 509