Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
Detects the creation of services or remote execution indicative of PsExec usage over SMB administrative shares. This behavior is commonly associated with lateral movement techniques used by threat groups such as Black Basta (Storm-1811) to execute payloads on remote systems.
Detects Microsoft Office applications (winword.exe or excel.exe) spawning shell processes (cmd.exe or powershell.exe). This behavior is commonly associated with malicious VBA macro execution in weaponized Office documents used for malware delivery, such as Dridex.
Detects the creation or modification of Windows Registry Run or RunOnce keys where the associated executable path is located in suspicious or non-standard directories (e.g., Temp, AppData, ProgramData). This behavior is characteristic of adversaries, such as APT28, attempting to maintain persistence by ensuring malicious code executes automatically upon user login.
Detects the loading of an unsigned or invalidly signed DLL from commonly abused user-writable directories (Temp, AppData, Public). This behavior is characteristic of DLL side-loading techniques, often used by threat actors like the Lazarus Group to execute malicious code via a legitimate, trusted application.
Detects a suspicious sequence where a process loads the .NET CLR (clr.dll or mscoree.dll) and shortly thereafter accesses specific low-prevalence file extensions (.raw or .pak) within high-risk directories (AppData/Local/Temp, ProgramData, or Users/Public). This behavior is characteristic of shellcode loaders (such as the WAV-shellcode loader) that decrypt and execute RAT payloads from obfuscated containers in memory. The rule intentionally excludes common desktop applications to minimize false positives.
This rule detects suspicious persistence activity involving known tools or names that are often masqueraded. It looks for the creation of registry run keys or scheduled tasks using names associated with common tools ('Canon Configuration Reader', 'Stardock DeElevation Tool') when the initiating process is not located in the expected vendor-authorized directories. The rule specifically alerts on devices exhibiting these behaviors within a short time window.
Detects Microsoft Outlook initiating outbound SMB or WebDAV network connections to external IP addresses. This behavior is indicative of exploitation of CVE-2023-23397, where a malicious reminder sound or attachment forces the victim's client to authenticate against an attacker-controlled remote share, potentially leaking NTLM hashes.
Detects the use of Windows administrative tools (vssadmin, wbadmin, and bcdedit) to delete Volume Shadow Copies, backup catalogs, and disable system recovery mechanisms. This behavior is highly indicative of preparatory stages for destructive wiper malware attacks, such as those historically observed by the Sandworm (Seashell Blizzard) group (e.g., CaddyWiper, Industroyer2).
Detects the execution of shortcut (.lnk) files located on removable media (USB) that spawn common Windows binaries (powershell.exe, cmd.exe, mshta.exe) with hidden window flags. This behavior is indicative of initial access or lateral movement techniques used by Mustang Panda (Earth Preta) for USB-based malware propagation and DLL side-loading.
This rule monitors DeviceProcessEvents for the execution of known malicious binaries associated with the SilverFox malware. It specifically looks for occurrences of three distinct SHA256 file hashes within the last 30 days.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
This rule detects various malicious indicators of compromise (IOCs) across multiple telemetry sources, including DNS queries, web network traffic, file executions, process creation, and email activity. It monitors for interactions with known malicious domains, URLs, file hashes, and specific sender email addresses to identify potential malware distribution or C2 activity.
This rule detects a sequence of suspicious activities involving files placed in 'ProgramData\Firefox'. It identifies the creation or modification of a non-standard executable within this folder, followed by its execution by a trusted process (or itself), and the subsequent creation of a Registry run key for persistence. This pattern is often used by adversaries for persistence mechanism implementation using masqueraded file names.
Detects a suspicious execution sequence associated with the SectopRAT loader. The rule monitors for ReportDump.exe being launched from a ProgramData directory by common scheduling or service host processes, followed immediately by the loading of a malicious sdkcra.dll library.
Detects the creation of scheduled tasks (Windows), cron jobs (Linux), or systemd timers where the initiating process is a common scripting or runtime interpreter (e.g., Python, Node.js, PowerShell, Java). This activity is often indicative of persistence mechanisms being established by a compromised agent or script-based process.
This rule detects anomalous spikes in network connections from a device to major LLM provider API endpoints (OpenAI, Azure OpenAI, Anthropic) by establishing a baseline for each device and identifying deviations exceeding a statistical threshold. Such behavior may indicate unauthorized data exfiltration or mass data processing using LLM services.
Detects package manager utilities (pip, npm, yarn, conda) being executed as child processes by Python or Node.js agent runtime processes. This behavior may indicate an unauthorized installation of plugins or tools within an AI agent framework, potentially bypassing secure deployment pipelines.
Detects when an AI agent's code execution sandbox (e.g., Python, Node.js, or Shell interpreters) initiates suspicious child processes. This includes the execution of network utilities for potential C2 (e.g., curl, nc, socat), the creation of interactive reverse shells, or the execution of credential harvesting tools (e.g., mimikatz, secretsdump), which suggests the AI agent's sandbox environment has been compromised or abused.
This rule monitors for network communication with known malicious infrastructure (IPs/domains) and the execution of specific suspicious file names. It correlates device network events, file system activity, and process execution, specifically flagging attempts to execute MSI installers or other binaries associated with the identified threat indicators.
Detects instances where the Windows Explorer process (the parent of the 'Run' dialog) spawns common command-line interpreters. This behavior is indicative of the 'ClickFix' phishing technique, where users are socially engineered to paste malicious commands into the Windows Run dialog.
Page 78 of 1908