Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects anomalous authentication patterns where a single source IP targets a high number of unique user accounts with failed authentication attempts over a rolling window. By filtering out SSO/Federated methods and specific service account patterns, this rule isolates low-and-slow brute-force or password-spraying activities designed to evade standard account lockout mechanisms.
Detects the use of native Windows utilities (vssadmin.exe, wmic.exe, wbadmin.exe, bcdedit.exe) to delete volume shadow copies, backup catalogs, or modify boot configuration data to inhibit system recovery, a common behavior observed during ransomware and wiper attacks.
Detects the deletion of volume shadow copies using common Windows administrative tools such as vssadmin, wmic, and PowerShell. This activity is frequently observed during the pre-encryption stage of ransomware attacks to prevent system restoration.
Detects Active Directory Certificate Services (AD CS) enrollment events (4886/4887) where a request includes an enrollee-supplied Subject Alternative Name (SAN). This behavior is characteristic of ESC1 certificate template abuse (e.g., using tools like Certipy or Certify) to request certificates that impersonate other users or machine accounts.
Detects a sequence of activity where a user receives a high volume of inbound emails (potential vishing or social engineering lures) within a short window, followed by the user executing Windows Remote Assistance or Quick Assist tools within the next 6 hours, which is highly indicative of remote access social engineering pre-cursors.
Detects the physical connection of unauthorized IP-KVM devices (e.g., PiKVM) to corporate endpoints, which could be used for remote control via HDMI capture and USB HID emulation. This detection monitors Plug and Play (PnP) events for specific device descriptors and hardware identifiers commonly associated with remote access hardware.
Detects git checkout of a bare 40-hex commit SHA or the literal FETCH_HEAD ref, executed by a recognized AI coding-agent process. Narrowed to the Plugin4Shell exploitation fingerprint (checkout of a pinned-SHA-shaped or FETCH_HEAD ref) rather than ordinary branch/tag checkouts, which these agents perform constantly during normal plugin installs.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule performs a retrospective search across device file and network events for indicators of compromise associated with the UNC6240/ShinyHunters actor's activity against PeopleSoft, specifically linked to CVE-2026-35273. It monitors for known malicious file hashes (JSP webshells and executables), connections to known C2 infrastructure, and DNS lookups for specific malicious domains.
IOC hunt across DNS, network, and file-hash telemetry for the Ledger Google Ads phishing campaign. Vercel redirect domains are matched by exact hostname (DNS query name / parsed URL host) rather than substring, eliminating false positives from unrelated strings that merely contain a look-alike domain fragment. GCS bucket and Google Sites path IOCs remain substring-matched since the bucket IDs and page slugs are already highly specific.
Detects a sequence of events where a user clicks a shared link to an AI chatbot conversation followed closely (within 15 minutes) by the execution of potentially malicious processes (mshta, powershell, cmd) that include suspicious command-line patterns indicative of ClickFix-style social engineering.
Detects a sequence of events where a user clicks a shared link to an AI chatbot conversation followed closely (within 15 minutes) by the execution of potentially malicious processes (mshta, powershell, cmd) that include suspicious command-line patterns indicative of ClickFix-style social engineering.
This rule detects potential post-compromise activity related to a campaign using MSP360-masqueraded installers and ScreenConnect remote access tools. It performs an IOC sweep across device file events for known malicious file hashes (associated with installers and post-compromise utilities) and device network events for connections to known malicious domains used for command and control.
This rule detects potential post-compromise activity related to a campaign using MSP360-masqueraded installers and ScreenConnect remote access tools. It performs an IOC sweep across device file events for known malicious file hashes (associated with installers and post-compromise utilities) and device network events for connections to known malicious domains used for command and control.
Detects a volumetric spike in RPC connection attempts (specifically port 135 followed by Netlogon binding) from a single host to a Domain Controller. This behavior is indicative of the exploit retry mechanism used by Zerologon (CVE-2020-1472) tools, which must attempt the authentication sequence thousands of times due to the low success probability of the all-zero byte ClientCredential.
This rule detects instances where the Faronics Deploy Agent process initiates the installation or download of ScreenConnect remote access software via PowerShell or the Windows Installer (msiexec.exe). This pattern is often indicative of authorized RMM deployment, but it is also a common tactic for adversaries to establish persistent remote access to endpoints.
This rule monitors for known malicious file hashes, command and control (C2) domains, and specific download URLs associated with identified threats. It correlates these indicators across process execution, file activity, and network connection logs to identify potential compromises or malicious activity related to the aware-cr1 infrastructure.
This rule monitors for known malicious file hashes, command and control (C2) domains, and specific download URLs associated with identified threats. It correlates these indicators across process execution, file activity, and network connection logs to identify potential compromises or malicious activity related to the aware-cr1 infrastructure.
Detects the 2CLoader malware dropping and executing a payload from user-writable directories such as Temp or Downloads. The rule identifies suspicious process lineage by checking for a parent-process spoofing scenario where the reported parent is explorer.exe, but the actual initiator is a different process, excluding common legitimate installer filenames to reduce noise.
Detects a process querying multiple distinct registry keys associated with virtual environments (VMware, VirtualBox, Wine) in a short time window. This behavior is indicative of environmental profiling performed by malware (such as 2CLoader) to detect sandbox or analysis environments prior to malicious payload execution.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Page 68 of 1908