Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,045 detections
Filters
Last updated
All Time
Detection languages
23,954
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects instances where PowerShell.exe spawns the .NET C# compiler (csc.exe) with command-line arguments referencing a '.cmdline' file. This pattern is commonly used by adversaries to compile malicious code in-memory, bypassing traditional disk-based file scanning.
Detects the execution of known development, scripting, and administrative tools (e.g., Python, Node.js, GCC, Docker) from non-standard or unauthorized file paths. The rule leverages allowlists for process names, publishers, and trusted installation directories to identify potentially unauthorized usage of powerful tooling often abused by attackers for post-exploitation activities.
This rule detects incoming email messages containing .zip attachments with filenames that mimic financial documents (e.g., NFe, DANFE, invoice-related keywords) combined with numerical strings. This naming pattern is commonly associated with phishing campaigns attempting to deliver malicious archives.
Detects unauthorized processes attempting to access sensitive Mozilla Firefox profile files such as cookies.sqlite, places.sqlite, and permissions.sqlite. These files contain sensitive information including cookies, history, and permission settings. Access by processes other than the legitimate Firefox executable may indicate credential theft, data exfiltration, or reconnaissance activities.
Detects suspicious processes (named UpdateAssistant.exe, AppUpdateHelper.exe, or SysMaintenance.exe) executing from specific file system paths and initiating network connections to known suspicious IP addresses (5.230.249.49, 40.124.169.27) on non-standard ports (27015, 27017). The rule correlates process execution from specific suspicious directories with network activity to identify potential command-and-control communication.
Detects the execution of suspected Hidden VNC (HVNC) backdoor components that demonstrate behaviors consistent with banking credential theft, specifically targeting keystroke logging APIs. The rule monitors for specific process names executing from suspicious directories often used for persistence.
Detects bulk read operations on AWS Secrets Manager or similar cloud secret stores where the accessed resources contain keywords related to cryptocurrency custody, private keys, or wallet material. This pattern is indicative of unauthorized exfiltration attempts by threat actors such as Slim Spider targeting digital asset infrastructure.
Detects execution of mass file-deletion or system wipe commands triggered by processes running from known persistence or staging locations associated with the CHOSEN BRICK campaign. The rule monitors for the combination of suspicious process paths (such as disguised winappx.exe or SysWOW64-lookalike directories) and destructive command-line arguments like 'del', 'cipher', 'format', or 'vssadmin' operations.
Detects the use of common command-line tools (curl, wget, python, etc.) to interact with known cloud provider metadata service IP addresses or URL paths, often performed by shell processes. This behavior is frequently associated with initial reconnaissance or attempts to steal identity tokens from cloud-based virtual machines.
Detects malicious processes associated with the HVNC backdoor (e.g., UpdateAssistant.exe, SysMaintenance.exe) concurrently running alongside identified security product processes on the same device. This behavior suggests the malware is performing automated reconnaissance of installed security software to inform further compromise actions.
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
Detects the execution of known HVNC (Hidden Virtual Network Computing) backdoor binaries identified by specific file names and staging directory paths. These binaries are designed to create hidden desktop sessions and perform input injection to facilitate unauthorized remote control of a compromised host.
This rule detects network traffic patterns indicative of a reverse shell established by DSCourier, a tool or script that leverages the ConfigurationRemotingServer interface to facilitate interactive command execution on a remote host.
Detects DNS queries for randomized subdomains (8-12 character alphanumeric labels) prepended to specific thematic .de parent domains. This pattern is characteristic of phishing infrastructure rotation and device-code phishing campaigns where adversaries dynamically generate domains to evade detection.
Detects incoming emails processed by Rspamd that exhibit suspicious authentication header signatures. The rule identifies emails lacking DKIM, ARC, or user agent information while simultaneously showing a zero receive count, potentially indicating spoofed, unauthenticated, or malformed phishing attempts.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Detects specific FTP commands (STOR, RETR, TYPE I) and passive mode responses directed to or originating from identified malicious IP addresses associated with the LucidRook threat actor. This rule monitors for potential file exfiltration, payload retrieval, and command-and-control communication over the FTP protocol.
Detects outbound SMTP communication to Gmail servers containing specific indicators of compromise (sender, recipient, or subject line) associated with the LucidKnight (LucidRook) malware campaign, indicating potential reconnaissance data exfiltration.
Detects network beaconing activity associated with the Casbaneiro (Metamorfo) banking trojan. The rule monitors for specific C2 communication patterns, including the 'client;' string and the 'VVx-4.3' version marker, which are characteristic of this malware's host reconnaissance and command-and-control exfiltration phase.
This rule detects potentially malicious activity where an executable with an MD5-formatted name is created in the user's temporary folder, followed by the creation of a registry key with a matching MD5-formatted name in HKEY_CURRENT_USER\SOFTWARE\ within 15 minutes. This behavior is indicative of a persistence mechanism where malware drops a payload in a temp directory and sets a run or autorun registry key to ensure its execution upon logon or startup.
This rule detects the execution of common command-line utilities (cmd.exe, mshta.exe, AutoIt3.exe) using command-line arguments that mimic legitimate service names or security analysis tools (e.g., 'Microsoft Update Superfetch Core Endpoint Service'). This behavior is indicative of an adversary attempting to mask malicious activity by using strings that resemble benign system services or localized security scanner output, likely for obfuscation or evasion.
Page 471 of 2907