Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
These rules detect various exploitation attempts targeting SharePoint to bypass SafeControls, an security mechanism used to restrict the types of controls allowed in web parts. The patterns match suspicious Register directives and markup injection techniques often associated with remote code execution or privilege escalation, as identified in CVE-2026-65660.
Detects the IIS worker process (w3wp.exe) used by SharePoint loading a specific combination of assemblies (PresentationFramework.dll, System.Xaml.dll, and System.Data.Services.dll). This behavior is indicative of an ExpandedWrapper/XamlServices.Parse() insecure deserialization gadget chain, typically associated with the exploitation of vulnerabilities like CVE-2026-65660, which enables fileless in-memory code execution.
Detects DNS queries for domains resolving to specific Cloudflare nameserver pairs associated with the Exvicy malware distribution framework. The rule monitors for NS records pointing to 'randy.ns.cloudflare.com' and 'stevie.ns.cloudflare.com', optionally filtering by domains containing keywords commonly used in Exvicy-themed phishing or C2 infrastructure.
Detects instances where the SharePoint IIS worker process (w3wp.exe) initiates command interpreters or known living-off-the-land binaries (LOLBins). This behavior is characteristic of post-exploitation activity, such as command execution following successful exploitation of SharePoint vulnerabilities involving insecure deserialization or malicious directive injection.
Detects HTTP POST requests directed to the '/api.php' endpoint with specific patterns characteristic of Exvicy/ClickFix malware C2 communication. The rule identifies suspicious action parameters (check, dl, or cb) and a specific 48-character hexadecimal 'k' parameter used for identifying infected state.
This rule detects suspicious outbound network connections originating from processes frequently abused in the Exvicy/ErrTraffic ClickFix malware delivery chain, specifically powershell.exe, msiexec.exe, and putty.exe. It also monitors for direct communication to known C2 IP addresses associated with the Exvicy threat actor, providing coverage for both the initial payload delivery and post-compromise C2 phases.
Detects outbound network traffic from internal hosts to a domain associated with the VelvetCake fileless malware variant. The rule specifically looks for HTTP requests to 'p1o2i3u4y5t6r7e8w9q0.medianewsonline.com' using specific login parameters ('Areyou=cake', 'OKey=', 'Who='), which is indicative of command and control activity linked to the Konni actor group.
Detects unauthorized processes reading sensitive Chromium-based browser files (e.g., Cookies, Login Data) immediately following the termination of a browser process. This behavior is indicative of credential harvesting malware, such as RevStealer, which terminates the browser to release file locks before exfiltrating the databases.
Detects a single process accessing files across three or more distinct cryptocurrency wallet application directories within a one-hour window. This behavior is highly anomalous for legitimate applications and is characteristic of information-stealing malware, such as RevStealer, which targets stored credentials and wallet files.
Detects outbound HTTP POST requests to the 'vpugy.vcqi' domain, which is associated with RevStealer malware exfiltration. The rule specifically looks for traffic using a spoofed Chrome/147 user-agent and specific cookie artifacts used for session tracking in the exfiltration communication.
This rule detects instances where PowerShell is launched with hidden window arguments by explorer.exe or mshta.exe, and the command line indicates interactions with specific file extensions (.vbs, .ps1) located within the AppData directory. This pattern is often indicative of malicious script execution, such as those used in Konni malware campaigns to drop and execute payloads.
Detects execution of PowerShell commands indicative of the VelvetCake variant of the Konni malware. The rule identifies the use of 'Net.WebClient.DownloadString' combined with 'Invoke-Expression' (iex) to execute scripts in memory, alongside specific command-line indicators such as the 'Areyou=cake' campaign marker or associated C2 domains.
Detects unauthorized access to critical Chromium-based browser credential databases (such as Login Data, Cookies, and History) by processes other than recognized browser executables. This behavior is indicative of credential-harvesting activity, specifically matching techniques employed by infostealers like RevStealer.
Detects the execution of a RevStealer native PE payload by an Electron-based loader (XabivSystem.exe). The rule identifies when the loader spawns an unsigned, detached process from a hidden, randomly-named subdirectory within the user's AppData folder. This process creation is a precursor to the malware's environment checks, anti-VM/sandbox gating, and CAPTCHA verification routines.
Detects a non-privileged user creating a new DLL file within the C:\ProgramData\CrossDevice\ directory on a system that has specific COM registration keys (CLSID {135fd325-45b7-4c30-89f8-4386961669f0} or {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}) pointing to potentially missing or hijacked InprocServer32 paths. This is a common technique used for COM Hijacking or Persistence via phantom DLL loading.
Detects instances where dllhost.exe (COM Surrogate) running under high-integrity accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) loads an unsigned DLL file located in the C:\ProgramData\ directory. This pattern is commonly associated with DLL side-loading or malicious library injection to maintain persistence or escalate privileges.
Detects the loading of an unsigned or attacker-controlled DLL into a SYSTEM-context dllhost.exe process, consistent with the exploitation of dangling COM CrossDevice CLSIDs (e.g., forcing ICreateObject::Proc3 to LoadLibrary from a C:\ProgramData location).
Detects instances where dllhost.exe (COM Surrogate) running under high-integrity accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) loads an unsigned DLL file located in the C:\ProgramData\ directory. This pattern is commonly associated with DLL side-loading or malicious library injection to maintain persistence or escalate privileges.
Detects the execution of PowerShell commands that leverage specific tooling for scheduled task enumeration, commonly used for discovery or persistence management. The rule flags usage of 'Get-AccessibleScheduledTask' in conjunction with flags associated with tools like NtObjectManager or OleViewDotNet.
This rule detects suspicious PowerShell activity involving the enumeration and manipulation of COM objects and .NET assemblies, patterns often associated with reconnaissance or post-exploitation activities. It flags instances where PowerShell scripts utilize specific command-line arguments (e.g., Get-ComDatabase, Get-ComClass, Import-Win32Module, NtObjectManager) in conjunction, suggesting automated discovery of COM infrastructure or assembly loading.
Detects non-browser processes accessing sensitive browser credential stores (e.g., Login Data, Cookies) and cryptocurrency wallet files within a short time window. This pattern is characteristic of infostealer malware like Vidar, which grabs browser and wallet data for exfiltration.
Page 455 of 2907