Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Identifies devices with Signal software flagged by Defender Vulnerability Management for CVE-2026-113380 (RingRTC before 2.72.0, hangup commands dropped when call state machine queue is flooded). Exposure rule, not an exploit detection; results are deduplicated per device and sorted by recent Signal activity.
Detects a Python process spawning msiexec.exe followed by a high volume of LDAP connections (burst) from the same device within a 30-minute window, potentially indicating post-exploitation activity such as domain enumeration.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects outbound network connections from processes targeting a known hard-coded Potassium campaign C2 IP address (134.199.154.64), followed by fallback DNS resolver queries using standard public DNS servers by the same process.
Detects the writing and subsequent loading of driver files signed by a specific certificate holder (Wenjiang District Mingyu Network Technology), utilizing DeviceFileCertificateInfo, DeviceFileEvents, and DeviceImageLoadEvents.
Detects googleupdate.exe loading an unsigned DLL from a non-standard path, followed by network communication to a known Command and Control (C2) domain or IP address.
Detects non-browser processes contacting multiple distinct cloud storage APIs within a one-hour timeframe, a pattern indicative of potential multi-service command and control or data exfiltration.
Detects instances where inst.exe running from C:\ProgramData\Intel with specific command-line arguments (extensionless and key-like) subsequently writes files to the EFI system partition or boot paths on the same device.
Correlates the modification of the Explorer Policies Run registry key (specifically the 'Loader' value) with the creation or modification of a .url shortcut file in the user Startup folder on the same device within a 1-hour window, using the same initiating process.
Detects registry-based User Account Control (UAC) bypass activity where command keys for ms-settings or mscfile are created or modified under HKCU Software\Classes, correlated with a privilege adjustment (SeDebugPrivilege or SeLoadDriverPrivilege) by the same process within a 30-minute window.
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects the presence of Cisco SD-WAN vManage software, vulnerabilities related to CVE-2026-76504, associated file artifacts, and process executions across endpoints using inventory and event logs.
Detects sandbox or training hosts performing DNS resolution followed shortly by outbound connections to public IP addresses on ports 80 or 443, which may indicate a firewall misconfiguration or unauthorized egress from isolated environments.
Detects a process with no prior AI API activity in the past 14 days suddenly generating a high volume (200+ calls) of network connections to public AI inference endpoints (OpenAI, Anthropic, Grok, OpenRouter). This behavior is consistent with stolen API keys being used to drain resources or exfiltrate data from a newly compromised host.
Detects NTDSUtil commands associated with Active Directory database export, installation media preparation, and snapshot creation, which may facilitate offline credential extraction.
Correlates internet-origin executable creation with subsequent execution by Windows shell processes using matching device, file path and SHA1 hash within a five-minute timeframe.
Detects the download of potentially suspicious executables, scripts, or archives originating from code hosting platforms like GitHub, GitLab, and various mirrors where files have low prevalence and lack valid signatures.
Detects the execution of built-in Windows utilities such as vssadmin, wmic, wbadmin, and bcdedit performing recovery inhibition actions, including deleting volume shadow copies, resizing shadow storage, clearing the backup catalog, disabling recovery options, and configuring boot policies to ignore failures.
Detects newly seen devices (no Tailscale process activity in the prior 30 days) executing Tailscale enrollment or login commands followed by outbound network connections to Tailscale control infrastructure within 10 minutes, potentially indicating unauthorized VPN tunneling.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Page 7 of 509