Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
Detects a sequence of suspicious activities associated with credential dumping and inhibiting system recovery. The rule tracks when a user account executes multiple commands related to volume shadow copies (vssadmin, rmdir, mklink) or attempts to copy sensitive registry files (SAM, SYSTEM, SECURITY) within a 15-minute window on the same device.
Detects Node.js or ProfileQuickHost processes performing file operations (read, write, rename) on sensitive browser directories, such as 'Local Extension Settings' or wallet-related folders. This pattern is commonly observed in credential-stealing malware attempting to extract browser-stored secrets or cryptocurrency wallet data.
Detects a sequence of events consistent with credential dumping of sensitive Windows registry hives (SAM, SYSTEM, SECURITY). The attack involves querying shadow copies using vssadmin, creating a symbolic link to the shadow copy volume via mklink, and copying the hive files from that location. Cleanup attempts using rmdir are also monitored.
This rule detects network connections and DNS queries directed towards specific malicious domains or domains matching a pattern hosted on pages.dev, a service frequently abused for hosting malicious infrastructure such as phishing pages or command-and-control beacons.
This rule monitors DeviceNetworkEvents and DnsEvents for connections to known malicious domains and IP addresses associated with phishing campaigns. It alerts on any network communication or DNS resolution attempt targeting these indicators, providing visibility into potential user interaction with phishing infrastructure.
This rule detects network connections from internal devices to known SpiceRAT Command and Control (C2) infrastructure IPs. The detection filters for successful connections on common ports (80, 443) that meet a volume threshold, indicating potential ongoing beaconing or communication with malicious infrastructure.
ChainScript file manager 'files' task: node.exe performing high-volume recursive deletion within masqueraded ChainScript installation paths (drive enumeration, dir listing, file read/write, recursive delete)
This rule monitors DeviceNetworkEvents for any outbound network connections initiated from Windows devices to the domain 'files.surveillance-online.com', which is associated with malicious activity.
KQL Query
KQL Query
Detects instances where critical system processes (such as svchost.exe, lsass.exe, or w3wp.exe) spawn known command-line interpreters or script execution utilities (e.g., cmd.exe, powershell.exe, certutil.exe) which then initiate outbound network connections to common ports (445, 3389, 135, 5985, 5986, 1433, 80, 443) that are external to the local network. This behavior is often associated with lateral movement, command and control (C2) communication, or reconnaissance.
Detects the creation, modification, or execution of known malicious files associated with the Kimsuky threat actor, based on a static list of MD5 hashes observed in their campaigns.
This rule monitors for the execution or presence of files matching a specific set of known malicious MD5 hashes within the environment. It leverages DeviceFileEvents and DeviceProcessEvents logs to identify if these specific files are being accessed or executed on managed endpoints.
Detects process command lines containing LLM tool-calling syntax (e.g., 'tool_call', 'function_call') in conjunction with keywords associated with offensive security capabilities (e.g., 'exploit', 'mimikatz', 'exfiltrate'). This pattern is consistent with the behavior of malicious LLM-based agents attempting to autonomously invoke and execute offensive tasks.
Detects instances where a single process on a device communicates with two or more distinct hosted LLM provider APIs (OpenAI, Anthropic, DeepSeek, Google) within a 24-hour window. This behavior is indicative of multi-model orchestration or 'consensus' techniques, which may be employed by sophisticated implants for automated tasking, data processing, or evasion.
Detects instances where a single process on a device communicates with two or more distinct hosted LLM provider APIs (OpenAI, Anthropic, DeepSeek, Google) within a 24-hour window. This behavior is indicative of multi-model orchestration or 'consensus' techniques, which may be employed by sophisticated implants for automated tasking, data processing, or evasion.
This rule monitors DeviceNetworkEvents and DnsEvents for any network connection attempts or DNS queries directed towards the known malicious domain 'hyundaiservisiankara.com'. This pattern is indicative of a host attempting to communicate with an external C2 infrastructure.
Page 451 of 2907