Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects the creation or modification of ASPX/ASP files within specific SharePoint web server directories on devices identified as vulnerable to CVE-2025-49706 or CVE-2025-53770. It leverages vulnerability management data to narrow down the scope to only vulnerable SharePoint servers, then monitors file events in common SharePoint LAYOUTS paths for web shell indicators. The rule also uses file profiling to identify potentially novel or malicious ASPX/ASP files that lack Defender visibility.
The analytic detects potentially suspicious modifications to Windows Audit Policy auditing options registry values. It focuses on changes to specific auditing option values ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. Such modifications could indicate a threat actor attempting to tamper with audit policy configurations, potentially disabling SACLs (System Access Control Lists) to bypass defenses and facilitate further malicious activities like machine compromise or lateral movement.
Hunt malicious abuse of BITS (Background Intelligent Transfer Service) for file transfers, code execution, and persistence, analyzing command-line patterns and suspicious process chains commonly used by attackers.
This detection identifies instances where the diskshadow.exe utility is executed by a privileged user shortly after a successful logon. diskshadow.exe is a legitimate tool often abused by attackers for shadow copy manipulation and data exfiltration. Monitoring its use by privileged accounts helps identify potential malicious activity.
This rule detects the execution of known Remote Monitoring and Management (RMM) tool processes or network connections to domains associated with RMM tools. It leverages an external CSV file containing a list of RMM tool executable names and their associated domains to identify suspicious activity. The rule aims to identify the presence and use of legitimate RMM software, which can be abused by adversaries for remote access and control.
Detects potential email harvesting using PowerShell cmdlets with export parameters, stealth flags, and uncommon parent processes.
This rule detects attempts to flush Shimcache using rundll32.exe, which can indicate anti-forensic activity or defense evasion by an attacker. The detection logic specifically looks for command-line arguments associated with flushing the Shimcache, including function names like "ShimFlushCache" or "BaseFlushAppcompatCache", and also checks for ordinal values combined with specific DLLs like "apphelp.dll" or "kernel32.dll".
Detects potential Raven Stealer activity by identifying known artifacts such as specific file paths, created filenames, command-line arguments, network connections, and file hashes.
Hunting WMI execution from remote system
This detection identifies outbound NTLM authentication attempts to remote SMB servers with suspicious characteristics consistent with the use of impacket-smbserver, a tool commonly used by adversaries for lateral movement and data exfiltration. The detection looks for RemotePort 445 traffic where:
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
Detects instances where sensitive process lsass.exe is accessed by potentially malicious or abused utilities like powershell.exe, cmd.exe, rundll32.exe, or wmic.exe, which may indicate credential dumping or reconnaissance activity.
It also captures admin tools commonly abused for credential dumping, including memory dump indicators via DLLs like comsvcs.dll.
It also captures admin tools commonly abused for credential dumping, including memory dump indicators via DLLs like comsvcs.dll.
This query identifies suspicious use of appcmd.exe to install IIS native-code modules via command line, excluding legitimate installations initiated by iissetup.exe. It’s useful for spotting potential backdoor deployments like RGDoor or other malicious IIS extensions.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
Analytic detect abnormal pattern of command and scripting interpreter followed by USB mount
This rule identifies devices that are both critical to the organization (based on exposure graph data) and are vulnerable to CVE-2024-30040. It leverages Microsoft Defender Vulnerability Management data to correlate critical assets with known vulnerabilities.
This query identifies devices with frequent outbound HTTP/HTTPS connections to external IPs, suggesting possible chunked data exfiltration.
CVE-2025-53770 Exploitation hunt
Scan for 18 malicious extensions
This rule detects network connections and DNS queries to known command and control (C2) infrastructure associated with Lumma Stealer malware. It leverages a regularly updated external list of indicators of compromise (IOCs) including IP addresses and domains to identify malicious communication attempts.
This rule detects attempts to modify the local Administrators group using the 'net localgroup administrators' command. This command is often used by adversaries to add users to the local administrators group for privilege escalation or persistence.
This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.
Page 474 of 509