Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects the loading of Aspose.Email DLLs from suspicious user-writable or temporary directories. This behavior is indicative of an attacker potentially using a legitimate library for malicious purposes, possibly to evade detection or to collect information, rather than an approved mail application loading it from its intended location.
This rule detects when a newly dropped executable, likely from temporary or download directories, performs broad registry reconnaissance. Specifically, it looks for access to registry keys related to software, internet settings, credentials, vaults, and uninstall information. The XQL view includes actor and causality fields to aid in investigation.
Identifies the creation or modification of the 'NvmProtocal' registry value within the CurrentVersion\Run key. This mechanism is used by the cross-platform infostealer associated with the compromised Mastra npm packages to maintain persistence across system reboots.
Detects the explicit execution of the 'gh-token-monitor.sh' script, which is indicative of active credential harvesting on the endpoint. This script is designed to monitor and potentially exfiltrate GitHub tokens.
Detects command-line parameters indicating RPC calls to Ethereum/Polygon for C2 resolution, specifically looking for 'eth_call' and known blockchain service providers like 'drpc.org', 'tenderly', 'flashbots', or 'blastapi'. This activity is indicative of the EtherHiding malware.
This helps identify legitimate DAEMON Tools binaries - DTHelper.exe, DiscSoftBusServiceLite.exe, or DTShellHlp.exe used as a communication vector to an external domain env-check.daemontools.cc, which sends shell commands to the compromised host.
Detects a hidden or borderless topmost window created by a non-browser process while an online banking session is active, specifically looking for processes named 'banana', 'client', 'update', or 'service' with command-line arguments indicating a full-screen or overlay window related to banking, updates, or security.
SYSTEM-Context PST or OST Collection
Cortex XDR
This rule detects suspicious access to Outlook data files (.pst or .ost) by processes running in the SYSTEM context, excluding legitimate Outlook-related processes. It focuses on identifying non-standard applications or scripts attempting to collect mailbox data, potentially indicating data exfiltration or unauthorized access. The rule leverages causality fields for enhanced investigation.
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Detects the legitimate Microsoft binary Fondue.exe loading APPWIZ.cpl from a non-standard public directory (C:\Users\Public\), indicating DLL side-loading, a technique observed in campaigns like Dropping Elephant.
Identifies the Node/Python payload initiating outbound queries to Solana RPC nodes to fetch encoded C2 instructions hidden in blockchain transaction memos.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
Detects the consequence of the BYOVD exploit: the sudden termination or crash of protected EDR/AV processes (MsMpEng.exe, Sense.exe, csrss.exe tampering) in conjunction with the loading of the 'EEDbg.sys' driver, which is associated with the EnCase BYOVD technique.
Detects the use of `wget` or `curl` to specifically target a GitHub API endpoint with a suspicious string, indicating an attempt to download initial stage malware or tools from a dead drop. This pattern is associated with supply chain attacks where GitHub is used as a temporary hosting for malicious components.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
Detects an environment where 'bun' is executing both the primary ('setup.mjs') and secondary ('execution.js' or 'bw_setup.js') payloads within an hour, indicating a potential supply chain attack.
Detects a loader command or memory-scanning utility referencing the Policy.dllcppage.dll marker that ZiChatBot replaces with its terminate.dll path. This rule specifically looks for process command lines containing both 'Policy.dllcppage.dll' and 'terminate.dll' executed by processes with filenames like python, rundll32, vcpktsvr, or loader.
Detects attempts to exfiltrate environment variables by piping the output of 'env' or 'printenv' commands into 'curl'. This technique can be used by adversaries, such as the Miasma malware, to quickly steal sensitive API keys or other credentials stored in environment variables.
Detects execution of 'transformers.pyz', a zipped Python payload associated with the Miasma toolkit, by monitoring process creation events for command lines containing both 'python' and 'transformers.pyz'.
Detects the execution of the Chisel client establishing a reverse SOCKS tunnel with authentication. This activity is often associated with adversaries using Chisel for command and control or data exfiltration.
Correlates payload execution with anomalous BitTorrent DHT UDP traffic (ports 10000/6881) used for distributed C2 path retrieval.
Page 60 of 100