Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects rapid creation of numerous .lnk shortcut files on removable media volumes, specifically targeting filenames that mimic common installers (e.g., ChromeSetup, AnyDesk). This behavior is characteristic of worm-like malware attempting to use removable drives for persistence and lateral movement by masquerading as legitimate software.
Detects network connections over port 443 to domains that have not been observed in the environment during the preceding 30-day window, specifically targeting domains with character-diversity patterns indicative of algorithmic generation rather than standard human-readable naming conventions.
Detects a suspicious pattern where a user authenticates to a remote access portal (like Citrix or VPN) without multi-factor authentication (MFA) or with an existing risk flag, followed by a surge in file activity (creation, modification, or renaming of >500 files or >200 distinct files) on the same account within a 24-hour window, potentially indicating compromised credential usage for staging data for exfiltration or ransomware.
Detects execution of AgtaBackupAgent.msi via command-line tools such as PowerShell or msiexec.exe. This activity is monitored as it may indicate an attempt to install backup software or potential malicious masquerading using the MSI installer, particularly when using silent flags or accessing from temp directories.
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
This rule detects attempts to exploit the Microsoft Support Diagnostic Tool (MSDT) vulnerability CVE-2022-30190, known as 'Follina'. The rules monitor for malicious HTTP traffic and payloads that leverage the 'ms-msdt' URI scheme to execute arbitrary commands, often delivered via weaponized documents or external references to remote malicious HTML files.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
Detects the clearing of the Windows Security event log, which generates Event ID 1102. This action is often performed by adversaries to cover their tracks after performing malicious activities on a compromised host.
Detects potential ransomware activity characterized by the mass renaming of files with specific extensions (.locked, .locked_wip) or the creation of known ransomware note filenames (RESTORE_FILES.txt) on a Windows system.
Detects instances where the Microsoft Edge proxy process (msedge_proxy.exe) initiates command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe. This behavior is highly suspicious as a browser-related process should not typically be spawning shell interpreters, potentially indicating exploitation of browser vulnerabilities or malicious script execution.
Detects process/file hashes associated with the ChatGPT Custom GPT ClickFix
campaign via Windows process_creation telemetry. Split from the combined IOC
hunt: Sigma supports only one logsource per rule, so IP/domain/URL matching live
in separate network_connection and dns_query rules.
campaign via Windows process_creation telemetry. Split from the combined IOC
hunt: Sigma supports only one logsource per rule, so IP/domain/URL matching live
in separate network_connection and dns_query rules.
Detects process/file hashes associated with the ChatGPT Custom GPT ClickFix
campaign via Windows process_creation telemetry. Split from the combined IOC
hunt: Sigma supports only one logsource per rule, so IP/domain/URL matching live
in separate network_connection and dns_query rules.
campaign via Windows process_creation telemetry. Split from the combined IOC
hunt: Sigma supports only one logsource per rule, so IP/domain/URL matching live
in separate network_connection and dns_query rules.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
Detects the execution of script interpreters (PowerShell, Cmd, Mshta) launched directly from common web browsers (explorer, chrome, edge, firefox). The rule specifically flags common obfuscation techniques such as encoded commands, hidden window styles, or attempts to download and execute code (e.g., IEX, DownloadString) while excluding explicit file-based script executions.
Detects unauthorized processes attempting to read sensitive wallet extension storage files or desktop application wallet data folders, a behavior characteristic of the Psychedelic Stealer malware designed to harvest cryptocurrency credentials prior to exfiltration.
Detects instances where the SQL Server process (sqlservr.exe) initiates command-line utilities such as cmd.exe or powershell.exe, and further identifies suspicious command-line arguments often associated with post-exploitation activity like discovery, credential gathering, or file manipulation.
Detects attempts to terminate common antivirus and security software processes using 'taskkill.exe' with force flags. The rule specifically correlates this behavior with SQL Server processes (initiating or present on the host), suggesting an attempt to disable security controls to facilitate unauthorized activity or persistence.
This rule detects a potential brute force attack against the Microsoft SQL Server 'sa' administrative account. It identifies a high volume of failed authentication events (Event ID 18456) for the 'sa' account within a 10-minute window, followed by a successful authentication event (Event ID 18453 or 18454) from the same source IP address. The rule specifically filters for successful logins originating from non-private (internet-facing) IP addresses, suggesting an attempt from an external threat actor.
Detects the loading of known DLLs (WinSparkle.dll, libcurl.dll, vim64.dll, dbghelp.dll, jli.dll, nvml.dll) from suspicious or non-standard file paths. The rule cross-references these image loads with file activity, identifying potential side-loading scenarios where a library is loaded from an unexpected directory or within an archive-related context. It also includes an explicit hash-based detection for a known malicious file.
Page 79 of 1908