Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,665 detections
Filters
Last updated
All Time
Detection languages
10,181
119
110
99
60
Contributors
2,815
2,800
1,768
504
492
Categories
4,275
2,971
2,237
1,829
1,457
Platforms
10,376
1,102
802
155
98
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects modifications to the 'User Shell Folders' registry key, which can be abused by adversaries to alter the location of special folders (e.g., Desktop, Documents) to point to attacker-controlled locations, potentially for persistence or data staging.
Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.
This rule detects network connections and user sign-ins originating from IP addresses identified as belonging to Iran. It also identifies sign-ins where the reported country is Iran, but the IP address is not found within the provided Iranian IP list, which could indicate IP geolocation discrepancies or obfuscation attempts.
This rule detects the creation or interaction with mutexes that contain both 'asus_' and '_v' in their names. This pattern has been observed in malware associated with ASUS systems, potentially indicating the presence of malicious software attempting to establish a unique identifier on the compromised system.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash. The rule looks for the presence of this hash in DeviceFileEvents (file creation on disk) or DeviceImageLoadEvents (module loaded into a process). This indicates an attempt to steal credentials from web browsers or web session cookies.
This rule detects the presence of the string "xhxhxhxhxhxpp" within the AdditionalFields of DeviceEvents. This string =represents a Mutex Indicator of Compromise (IOC).
This rule detects various stages of the VOID#GEIST multi-stage Python loader as described in the Securonix blog. It identifies initial batch file execution, Chrome decoy PDF lures, hidden PowerShell relaunching of the batch file, persistence via the Startup folder, curl commands downloading zip payloads, Python embedded runtime downloads, and final Python payload execution. The rule is designed to catch the distinct command-line patterns associated with each stage of this specific malware.
This rule detects the creation or modification of scheduled tasks using specific names identified in the Bitdefender APT36 Vibeware report. The rule looks for `schtasks.exe` executions where the command line contains one of the following task names: "MicrosoftEdgesUpdatesTasksMachineUAs-Task", "MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy", "DateAndTimeService", "personalServiceTask", or "LuminousBackupService". This helps identify campaign-specific persistence mechanisms used by APT36 Vibeware.
This query provides a 360-degree view of a phishing campaign's impact. Starting from a reported email's indicators (sender, subject), it finds all similar emails and correlates them with user actions like URL clicks, attachment interactions on endpoints, replies, and if the emails were zapped by Microsoft. This allows an analyst to quickly scope an incident and determine the extent of compromise.
Detects attempts to aggressively hijack file associations by modifying the Windows Registry using 'reg.exe' or 'cmd.exe'. Specifically looks for command-line arguments indicating deletion of 'UserChoice' registry keys (which define default applications for file types) and addition of 'ApplicationAssociationToasts' keys (which can suppress notifications related to file association changes). This behavior is indicative of an attacker trying to silently change default applications to maintain persistence or execute malicious code.
Detects the creation of files with the '.waiting' or '.wait' extension, which are appended by Crytox ransomware to encrypted files. This rule specifically looks for file creation events where the filename ends with these characteristic extensions, indicating potential ransomware activity.
This rule detects network connections to known pastebin and text storage sites initiated by processes that are not common web browsers. This could indicate data exfiltration, staging of malicious code, or command and control activity where sensitive information is uploaded or retrieved by non-standard applications.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash.
This rule detects network connections from devices to a list of known malicious domains. These domains are often associated with command and control (C2) infrastructure or other malicious activities.
This rule detects brute force activity based on 'BruteForceActivityDetected' events from DeviceEvents. It identifies the attacking IP, the device being attacked, the credential being targeted, the workstation name, domain name, and the type of attack. It then summarizes the count of attacks per unique combination of these fields, ordered by the attack count.
This rule detects the presence of specific file hashes associated with the TrustConnect campaign on devices. It directly identifies known malicious lure files by their SHA256 hash, providing a narrow and high-confidence detection for triage and initial checks.
Detects the use of curl.exe where the User-Agent string contains a URL pointing to temp.sh. This specific TTP was observed in the Notepad++ supply chain attack (Chrysalis infection chain) to exfiltrate system information and signal the uploaded file's location to the C2 server.
This rule detects the execution of 'CheckNetIsolation.exe' with the command-line arguments 'LoopbackExempt' and 'aad'. This specific command is used to exempt Universal Windows Platform (UWP) or Store apps from network loopback restrictions, often in the context of Azure Active Directory (AAD) authentication. While this can be a legitimate operation for development or specific application configurations, it can also be abused by malicious applications to bypass network isolation.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.
This rule detects attempts to hijack file associations by monitoring command-line executions of 'cmd.exe' or 'reg.exe' that involve deleting 'UserChoice' registry keys or adding 'ApplicationAssociationToasts'. This behavior is indicative of an adversary attempting to modify default program associations to achieve persistence or execute malicious code.
Page 444 of 508