Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects attempts to clear Windows event logs using built-in utilities like wevtutil.exe, PowerShell commands (Clear-EventLog, Remove-EventLog), or the detection of Event ID 1102 (Log cleared). This activity is commonly used by adversaries, including ransomware affiliates, to obfuscate their tracks during or after an attack.
Detects persistence attempts by monitoring Windows Registry Run and RunOnce keys for suspicious file paths (e.g., AppData, Temp, Users\Public) or the execution of non-standard script and binary file types (e.g., .vbs, .js, .ps1, .hta, wscript, cscript, mshta). These indicators are common signs of malware or unauthorized software maintaining persistence on a system.
Detects the execution of reconnaissance commands designed to enumerate Active Directory domain trust relationships. Attackers, including those associated with ransomware operations like INC Ransom, use these tools to map organizational structures and identify pathways for lateral movement and cross-domain propagation.
Detects the creation of web scripts (aspx, php, jsp) in typical web server directories followed by suspicious shell activity (cmd, powershell, or shell execution) originating from web server processes within a 10-minute window. This behavior is indicative of a web shell being dropped and subsequently utilized for command execution.
Detects the WMI provider host process (WmiPrvSE.exe) spawning common command-line or system administration tools such as cmd.exe, powershell.exe, or rundll32.exe. This activity is correlated with a preceding network connection to the host on port 135 (DCOM/WMI), which is indicative of lateral movement using WMI.
Detects periodic network connection patterns indicative of Cobalt Strike beaconing. The rule identifies low-variance jittered traffic, where the communication interval remains relatively consistent over a defined period, consistent with default Cobalt Strike malleable C2 profiles.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects anomalous lateral movement behavior where a successful NetScaler VPN or gateway session is followed immediately by internal remote service logons (RDP, SSH, WinRM) or network connections from the same source IP. This pattern is indicative of potential exploitation of Citrix NetScaler vulnerabilities (e.g., CVE-2026-88771, CVE-2026-88772) or credential abuse to move laterally into the internal environment.
Detects techniques commonly used to dump Active Directory domain credentials by accessing the NTDS.dit database file. This includes the use of ntdsutil for IFM (Install From Media) operations, manual shadow copy creation using vssadmin or wmic to copy the ntds.dit file, direct access to shadow copy volumes containing sensitive database files, and the use of credential dumping tools like Impacket's secretsdump.
Detects the execution of the 'rnpkeys.exe' file from the 'C:\ProgramData\keyroll\' directory. The location and filename are highly atypical and could indicate unauthorized tool usage, potential persistence, or malicious activity.
Detects suspicious behavior by the IIS worker process (w3wp.exe) indicative of web shell deployment, specifically the spawning of command interpreters (cmd.exe, powershell.exe) or the writing of .aspx files. This activity is consistent with exploitation campaigns targeting MOVEit Transfer, such as those conducted by the Lace Tempest (Cl0p) group.
Detects usage of ntdsutil.exe with arguments designed to dump the Active Directory database (NTDS.dit) and the use of netsh.exe for establishing covert port forwarding. These are known 'Living-off-the-Land' (LotL) techniques observed in campaigns attributed to the threat actor Volt Typhoon.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
The following analytic identifies Living Off the Land Binaries and Scripts (LOLBAS) that can legitimately initiate public network connections but are communicating over uncommon destination ports.
It leverages the Network Traffic data model and applies per-binary common-port exclusions to reduce false positives while preserving suspicious non-standard communication.
This behavior may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries.
Join this detection with the Process Execution events to provide context and avoid false positives.
It leverages the Network Traffic data model and applies per-binary common-port exclusions to reduce false positives while preserving suspicious non-standard communication.
This behavior may indicate payload download, command-and-control, proxy execution, or attempts to blend malicious traffic into trusted Windows binaries.
Join this detection with the Process Execution events to provide context and avoid false positives.
Detects outbound network connections to known SectopRAT C2 infrastructure, specifically targeting the hardcoded IP 98.142.252.140 or the non-standard port 15847 often used for encrypted exfiltration.
Detects instances where AI agent runtime environments, such as Python or Node.js processes, spawn command interpreters to execute commands that suggest reconnaissance or unauthorized system manipulation. This behavior is indicative of a hijacked AI agent abusing its tool-use capabilities to execute commands outside of an approved workflow.
This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered.
Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones.
This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones.
This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
The following analytic identifies the first-time execution of child processes spawned by Zoom (zoom.exe or zoom.us). It leverages Endpoint Detection and Response (EDR) data, specifically monitoring process creation events and comparing them against previously seen child processes. This activity is significant because the execution of unfamiliar child processes by Zoom could indicate malicious exploitation or misuse of the application. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the endpoint.
ACL deletion performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage.
ACL modification performed on the domain root object, significant AD change with high impact. Following MS guidance all changes at this level should be reviewed. Drill into the logonID within EventCode 4624 for information on the source device during triage.
This detection identifies when a a new client side extension is added to an Active Directory Group Policy using the Group Policy Management Console.
Page 72 of 1908