Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,047 detections
Filters
Last updated
All Time
Detection languages
15,348
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,107
9,755
3,848
3,756
3,712
Platforms
40,047
7,319
6,542
3,903
3,663
Products / Services
10,432
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,063
5,948
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects interactive RDP logons (LogonType 10) occurring on domain controllers or VDI authentication servers where the originating workstation name follows naming conventions associated with VDI/virtual-desktop environments. This pattern is indicative of potential lateral movement, where an adversary pivots from a compromised user VDI instance directly to sensitive infrastructure, bypassing established administrative jump box protocols.
Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.
One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.
One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.
This rule monitors for indicators of compromise (IOCs) associated with known malware and C2 infrastructure, including specific IP:port combinations, malicious domains, URLs for file downloads, and SHA256 hashes of known malware. The rule correlates data across device network events, file events, and process execution events to identify potential infections or communication with malicious infrastructure.
This rule monitors for indicators of compromise (IOCs) associated with known malware and C2 infrastructure, including specific IP:port combinations, malicious domains, URLs for file downloads, and SHA256 hashes of known malware. The rule correlates data across device network events, file events, and process execution events to identify potential infections or communication with malicious infrastructure.
Detects attempts to disable Windows Defender by either executing known Defender Control utilities or by modifying registry keys associated with the disabling of anti-spyware features or the WinDefend service startup.
This rule detects potential post-exploitation activity where a web server process spawns a command shell, executes system discovery commands, and immediately initiates an outbound network connection. This behavior is indicative of a web-based exploit leading to interactive command execution and subsequent C2 communication.
Detects Impacket-style lateral movement patterns where system processes such as services.exe or wmiprvse.exe spawn command shells to copy files from a network share (UNC path) and execute them. This rule specifically looks for evidence of staging binaries or DLLs from remote shares, which is a common behavior of post-compromise frameworks like Impacket when performing 'hands-on-keyboard' actions.
This rule detects potential browser-based credential and session theft by monitoring for a process that accesses multiple sensitive web browser artifacts (cookies, local state, session storage) across several user profiles in a short timeframe. It correlates this activity with the subsequent creation of a compressed archive in a temporary directory followed by an outbound network connection, indicating a multi-stage exfiltration workflow.
Detects two distinct suspicious patterns: first, the deletion of executable files residing in common user-writable temporary directories (e.g., Temp, Downloads, AppData) using command-line tools like 'del' or 'erase', which is often indicative of anti-forensic activity after malware execution. Second, it monitors for network traffic involving HTTP POST requests or specific SOAP headers related to 'tempuri.org', which are commonly associated with default .NET WCF service scaffolding and may be used by adversaries for C2 communication or exfiltration.
Detects instances where a user account associated with a detected infostealer malware infection (e.g., Redline, Raccoon, Vidar) successfully authenticates to a cloud service from a suspicious network location, such as a VPN, residential proxy, or Tor exit node, within 24 hours of the infection alert.
Detects non-CLI and non-DevOps utility processes accessing sensitive cloud credential and configuration files, including AWS SSO caches, AWS credentials, kubeconfig, and gcloud configuration files. This behavior is indicative of credential theft or discovery by infostealers attempting to gain unauthorized access to cloud environments.
Detects the use of administrative utilities (psexec.exe, wmic.exe, powershell.exe, cmd.exe) initiating network connections over common remote management ports (135, 139, 445, 3389, 5985, 5986) to internal destinations. This behavior is indicative of lateral movement activity, particularly when initiated from a host that has recently engaged in credential harvesting or infostealer-related activity. The rule excludes common, expected sources to minimize noise.
Detects a behavioral pattern characteristic of Everest ransomware, where a sequence of rapid process terminations occurs within a 20-second window. The rule identifies the coordinated termination of security/analysis tools, antivirus/backup/database services, and other high-memory processes on a single device, excluding known legitimate maintenance processes.
Detects a potential WMI-based persistence mechanism by identifying the sequential execution of mofcomp.exe to compile a MOF file located in a temporary directory, followed by the execution of a VBScript payload using cscript.exe with the /e:VBScript.Encode flag. This pattern is indicative of an attacker attempting to establish persistence via WMI event subscriptions.
Detects host enumeration activities (listing processes, user information, and directory contents) performed by known legitimate binaries (e.g., poedit.exe, curl.exe, vim.exe) shortly after they have executed a suspicious sideloading event. This pattern is characteristic of the NeedyMantis actor performing initial discovery before C2 beaconing.
Detects a suspicious sequence of events characteristic of NeedyMantis's hands-on-keyboard activity. The rule identifies file staging (creation or modification of suspicious DLLs from network shares) followed by remote command execution (via Impacket-like service interaction) and subsequent execution of binaries vulnerable to DLL sideloading.
Detects attempts to redirect Python package resolution away from the default PyPI index. This is achieved by monitoring pip CLI arguments (--index-url, --extra-index-url), environment variables (PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, PIP_CONFIG_FILE), or the creation/modification of pip configuration files (pip.conf, pip.ini). Such activity is often associated with software supply chain attacks where an adversary attempts to force the installation of malicious packages from a controlled repository.
Detects a multi-stage infection chain associated with RedFlick, involving the delivery of VHDX files or PDF attachments. The rule correlates malicious activities such as SSH-based tool download (using PermitLocalCommand), PowerShell-based PDF decoding/extraction, PowerShell VHDX disk mounting, and silent MSI installation from remote URLs. It monitors for these activities within user-writable directories like Downloads or Temp.
Detects instances where the Windows command shell (cmd.exe) is used to execute 'dotnet --list-runtimes' with output redirected to sensitive locations (e.g., NUL, temp folders, or text/log files). This pattern is often observed during post-exploitation activities by RMM agents or unauthorized processes attempting to profile the .NET environment while hiding their command output.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
Detects the execution of known browser credential harvesting tools (WebBrowserPassView, WebBrowserBookmarksView, or WS_Password variants) from ScreenConnect temporary directories. This behavior often indicates post-compromise activity where an adversary uses an existing Remote Monitoring and Management (RMM) session to extract credentials from browsers.
Page 74 of 1907