Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects outbound network connections to known ClickFix campaign domains or the execution of the finger utility connecting to public IP addresses.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects the execution of NetSupport Manager client binaries (client32.exe or pcictlui.exe) from user-writable directories such as AppData, ProgramData, or Public folders, optionally spawned by script loaders or command interpreters.
Detects unauthorized access to virtual hard disk (VMDK) files by non-standard processes followed by the creation or modification of sensitive offline credential artifacts such as ntds.dit or SYSTEM hives on the same host within a 2-hour window, indicating potential offline credential theft.
Detects a sequence of events on a Linux device where a sudo command execution is followed within 15 minutes by a Perl process executing base64 decoding commands within the same SSH session.
Detects an executable running from the C:\Windows\ directory (excluding known benign applications) that establishes two or more distinct persistence mechanisms within a short timeframe, such as scheduled tasks, registry run keys, or startup folder shortcuts.
Detects the correlation between the loading of known stealer plugin DLLs outside of standard application paths and subsequent process activity accessing credential stores, sensitive files, or executing wireless key recovery commands.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects AI coding assistants and agents (such as Copilot, Cursor, Claude Code, etc.) spawning command-line interpreters (PowerShell, CMD, Node, Bun, Deno) with potential API keys, tokens, or credentials exposed in the process command line.
Detects endpoint network connections made to known staging IP addresses often associated with data exfiltration or staging activities.
Detects potential persistence establishment where an AOMEI-related process writes a DLL file to disk, followed by the creation or modification of a Windows service pointing to that same DLL within a 15-minute window.
Detects service-initiated processes using cryptocurrency mining algorithms, pool configurations, or miner-specific execution parameters.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
This detection flags a parent and child process pair on internet-facing Windows servers, where the parent is a web server process and the child is the process it launched. The web server processes covered are w3wp, httpd, nginx and Tomcat, including versioned Tomcat service executables such as tomcat9.exe and Tomcat running under java.exe, which is identified by the Catalina bootstrap class in its command line. A server is treated as internet-facing based on the most recent status recorded for it.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Instead of matching known web shell names, the query builds a baseline from the previous 30 days of process activity on each device and alerts when a pair appears in the latest window that has never been seen on that device before, so it can catch web shell activity it has never seen before. Because the baseline is held per device, a pair that is normal on one server does not hide the same pair appearing on another.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects script execution (such as wscript, cscript, mshta) spawned from a shell parent process (like explorer.exe or cmd.exe) referencing browser cache files (matching f_* in browser profile directories) or copying scripts to the local Temp directory as t.vbs.
Detects when a Bandizip executable loads an unsigned dynamic-link library (DLL) from outside the standard installation directory, where the Bandizip process was launched by explorer.exe, potentially indicating DLL side-loading.
Detects the creation of a Windows scheduled task with the name or command containing 'WinRTCS' correlated with WMI permanent event subscription activities or execution of the 'own_lib.ps1' watchdog script within a 1-hour window on the same device, using Microsoft Defender XDR tables.
Page 8 of 509