Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects Kerberos service ticket principal name (SPN) enumeration or exposure events occurring shortly after the execution of common remote access tools (such as Quick Assist, AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, or LogMeIn) on the same device.
Detects execution of Mimikatz or LSASS process memory credential theft techniques that are preceded by common discovery tools (such as nltest, net, adcmd, netexec, or kerbrute) on the same device within a 24-hour window.
Detects web requests originating from the RedTail botnet user-agent 'libredtail-http' attempting to exploit two or more distinct vulnerability families (such as Apache path traversal, PHP-CGI argument injection, PHPUnit eval-stdin, and ThinkPHP pearcmd) from a single source IP.
Detects the execution of an application named avscan.exe from suspicious writable directories such as Users Public, ProgramData, or AppData Local, followed by an outbound public network connection within a one-hour window.
Detects processes reconnecting to a public IPv4 or IPv6 address after at least 7 days of inactivity on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Command-and-control implants often sit idle and then call back to infrastructure they have contacted before. Private, loopback, link-local, multicast and documentation ranges are excluded, and connections are grouped by endpoint, process, remote IP and port, then split into the last 24 hours and the prior history. Backup agents, license checks, update services and scheduled jobs also reconnect on a long cycle, so triage by process, destination reputation and how rare the destination is.
Run this over a search window of 30 days or more.
Detects PowerShell commands using the call operator with 'Get-Command' (gcm) or 'Get-Alias' (gal) containing wildcards to resolve and execute sensitive cmdlets. This is a common technique to evade static string-based detections for commands like 'Invoke-Expression' or 'Invoke-WebRequest'.
This rule goes after the behauviour of a variant of REMCOS, a remote access trojan (RAT) that has been observed in the wild.
The rule looks for specific indicators of compromise (IOCs) and behaviors associated with this malware, such as unusual process creation patterns, network connections to known command and control (C2) servers, and specific file modifications.
The rule looks for specific indicators of compromise (IOCs) and behaviors associated with this malware, such as unusual process creation patterns, network connections to known command and control (C2) servers, and specific file modifications.
Detects the creation of a scheduled task utilizing an XML configuration file located in the C:\Users\Public\Documents directory. The CryptoBandits worm component creates these tasks to maintain persistence for both itself and the stealer payload.
Detects attempts to enumerate Active Directory user objects using the Get-ADUser cmdlet with wildcard filters. This technique is often employed by attackers to gather information about user accounts and their attributes.
Detects potentially malicious scheduled tasks that establish persistence using trusted Windows binaries, encoded PowerShell commands, or masqueraded task names commonly observed in malware and post-compromise activity.
Detects the creation or modification of Windows provisioning packages (.ppkg) by processes other than expected provisioning and servicing tools. Attackers, such as those utilizing the Sirius Backdoor, can abuse custom .ppkg files to maintain persistence across OS resets.
Detects a sequence of suspicious behaviors on a single device within a 4-hour window: web shell file creation by a web server process, subsequent credential extraction or dumping tooling execution (such as accessing LSASS, NTDS, or SAM), and enumeration of installed security software or endpoint sensors.
Detects cmd.exe launching curl.exe with TLS verification disabled, redirect following, an output file, and forced hostname-to-IP resolution, or the PowerShell Invoke-WebRequest with a certificate-check bypass switch, often associated with malicious trojan droppers.
Flags conhost.exe --headless launching a renamed interpreter or decoded payload (svchost.exe, synaptics.exe, certutil -decode, Users\Public, AppData, Temp) together with image-named payloads (.ico, .png), bot-ID markers (MRB_, DA_NEW_VER_, BOT) or a cmd/PowerShell/script-host parent.
Flags cmd.exe launched by a script host, Office or msiexec whose command line downloads with curl -s -o to a .pdf name and deletes with del /s /q, and involves Users\Public, AppData, conhost or --headless: the PXA Stealer
Detects potential staging and execution of files from the Microsoft Vault directory within AppData, often associated with adversary tooling or credential theft.
This analytic detects selected processes spawned directly by Windows Remote Management Host processes winrshost.exe and wsmprovhost.exe.
The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration.
Investigate the account, target host, available command line, and surrounding remote-logon activity to determine context.
The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration.
Investigate the account, target host, available command line, and surrounding remote-logon activity to determine context.
Detects execution of various PHP interpreter binaries and evaluates their version regarding the new (CVE-2026-109618 / CVE-2026-109619) if upgraded or fix is needed.
Detects AnyDesk being silently installed with the --install and --silent flags or having an unattended-access password configured via the --set-password and _unattended_access parameters, typically piped via stdin from a batch dropper using cmd.exe.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Detects a sequence of process execution events where a device first downloads a public key (id_tunnel.pub) using curl or wget, subsequently downloads a private/tunnel key file (id_tunnel), and finally establishes an SSH tunnel or port forwarding session using ssh or a tun4000 script within a 4-hour window.
Page 7 of 1907