Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,314
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects file events involving NCrypt.exe, which may indicate process execution or file modification related to cryptographic functions or potential masquerading.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Surfaces Microsoft Defender alerts that reference Candiru/DevilsTongue spyware terms or associated CVEs (such as CVE-2021-31979, CVE-2021-33771, etc.) attributed in threat intelligence reports.
Surfaces Microsoft Defender alerts that reference Candiru/DevilsTongue spyware terms or associated CVEs (such as CVE-2021-31979, CVE-2021-33771, etc.) attributed in threat intelligence reports.
Detects the presence of known Candiru Windows DLL implant IOC hashes across device file events, process events, image loads, and email attachments.
Detects the presence of known Candiru Windows DLL implant IOC hashes across device file events, process events, image loads, and email attachments.
Detects the presence of known Candiru Windows DLL implant IOC hashes across device file events, process events, image loads, and email attachments.
Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration.
It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names.
This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.
It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names.
This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.
Sweeps network connection, HTTP/proxy, file, and process telemetry for exact matches against known Cling botnet indicators: dedicated STUN C2/operator IPs, Cling MIPS loader staging URLs, and known Cling sample SHA256 hashes. Tightened to exclude broad domain-level matching on stun.l.google.com (legitimate, ubiquitous Google STUN infrastructure that Cling spoofs/abuses rather than owns) and to match payload-staging hosts only by full URL rather than bare IP, reducing false positives from shared/compromised hosting and unrelated legitimate STUN traffic.
Detects historical network connections, URL clicks, browser launches, email URLs, and process command lines associated with Wazza phishkit infrastructure IOCs including boegl-krysl.eu, coppietersrecherche.eu, and beacon-surge-sync.workers.dev.
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
Detects a behavioral chain where PowerShell stages a hidden base64-encoded command and schedules a VBScript task, or PowerShell fetches an upgrade.txt file via web client methods for execution.
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects the execution of MATCHBOIL malware variants (PlannerAssistantManager.exe or RegularExpressionExplorer.exe) using specific command-line arguments (-auto, -plans, -renew) which trigger C&C logic.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
Detects unauthorized access to sensitive browser credential and session data files (e.g., Login Data, Cookies, Local State, key4.db) by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract saved credentials and session cookies to facilitate account takeover and bypass multi-factor authentication.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Page 47 of 1907