Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,764 detections
Filters
Last updated
All Time
Detection languages
3,724
2,041
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,231
485
Categories
5,723
3,080
1,138
901
659
Platforms
9,650
659
432
53
30
Products / Services
10,704
9,764
6,706
4,421
3,752
MITRE Techniques
3,828
3,377
1,982
1,618
1,042
CVEs
18
14
12
12
11
This rule detects various common command-line techniques used for network reconnaissance and internal environment enumeration on Windows systems. It tracks the execution of native tools such as ARP for ARP cache dumping, Ping for subnet sweeps, and NetBIOS or SMB-related commands (nbtstat, net view, net share, net session) to identify remote systems, network shares, and active sessions.
Detects the suspected RUSTYMOVE activity by identifying the creation of specific malicious files (ZIP and LNK) on the root directory of removable drives, followed by reconnaissance commands targeting removable media volumes.
This rule detects PowerShell script execution that interacts with the GitHub API, specifically targeting the upload of files or JSON data to repository endpoints. The logic looks for commands related to file system access, inclusion of 'api.github.com', and references to 'SmartUploader' or 'uploaded_files.json'. It further filters for activity occurring within standard user directories and enforces a check to ensure the GitHub repository name matches the local hostname, which is a common indicator of automated exfiltration scripts.
Detects the creation of a suspicious file named 'FitnessMonitor.exe' within the Windows Startup folder. This technique is commonly used by remote access trojans (RATs) to ensure persistent execution upon user logon.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects evidence of the RUSTYMOVE USB-propagation tool, associated with APT36 (Transparent Tribe). The rule identifies the creation of specific staged files (DriverInstaller.zip, DocScanner-11-Aug-2026-5-37pm.pdf.LNK) at the root of removable drives, as well as the creation of a 'log.txt' file on removable media that contains markers indicating successful file copying operations.
Detects individual file access events performed by non-browser python processes. This rule is designed as a proxy to identify automated file collection activities, such as those performed by 'python-httpx', that may be indicative of low-volume data exfiltration when aggregated over time.
Detects the creation of specific staging files and directories associated with the Rapuncel infostealer (e.g., UserInformation.txt, installed_applications.txt, sends.log, browser_decryption.log, or the Filegraber directory) within Windows temporary storage paths. This activity typically occurs following the unauthorized collection of sensitive data such as credentials, digital wallet information, and messenger session data.
Detects the loading of the Alinubx.sys kernel driver or the creation of an NvFsFilter service, which are associated with a BYOVD (Bring Your Own Vulnerable Driver) attack leveraging a renamed CcProtect driver to bypass security protections such as PPL.
Detects the execution of msiexec.exe to install an MSI package from a remote URL (http/https). The command line includes flags for passive installation (/passive) and an installation parameter (/i), initiated directly by Windows Explorer (explorer.exe), which is often associated with a user manually downloading and opening a malicious MSI file.
Detects process execution patterns consistent with the "ClickFix" social
engineering technique, where a user is lured (via a fake CAPTCHA, browser
error, or "verify you are human" page) into pressing Win+R, pasting a
pre-copied malicious command, and pressing Enter. This typically launches
PowerShell, mshta, cmd, or curl directly as a child of explorer.exe with
no legitimate parent chain (no browser, no script host), often with
obfuscated or encoded command lines, and frequently reaching out to
attacker infrastructure.
engineering technique, where a user is lured (via a fake CAPTCHA, browser
error, or "verify you are human" page) into pressing Win+R, pasting a
pre-copied malicious command, and pressing Enter. This typically launches
PowerShell, mshta, cmd, or curl directly as a child of explorer.exe with
no legitimate parent chain (no browser, no script host), often with
obfuscated or encoded command lines, and frequently reaching out to
attacker infrastructure.
Detects a classic process injection technique where an external process attempts to gain high-level access (OpenProcess with 0x1F0FFF) to charmap.exe. This activity is often a precursor to further injection steps such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, a behavior consistent with malicious payloads like AsyncRAT executed via an abused AutoIT interpreter.
Detects execution of mass file-deletion or system wipe commands triggered by processes running from known persistence or staging locations associated with the CHOSEN BRICK campaign. The rule monitors for the combination of suspicious process paths (such as disguised winappx.exe or SysWOW64-lookalike directories) and destructive command-line arguments like 'del', 'cipher', 'format', or 'vssadmin' operations.
Detects the execution of batch files from temporary directories that employ command obfuscation techniques such as environment variable substring expansion, or which execute with a hidden window in conjunction with chained system utilities commonly associated with malicious activities (e.g., curl, tar, schtasks). This behavior is often indicative of staged payload delivery and execution.
Detects the execution of batch files from temporary directories that employ command obfuscation techniques such as environment variable substring expansion, or which execute with a hidden window in conjunction with chained system utilities commonly associated with malicious activities (e.g., curl, tar, schtasks). This behavior is often indicative of staged payload delivery and execution.
Detects malicious file system activity where the legitimate Python interpreter (python.exe) is deleted and replaced or renamed to a deceptive filename (codeflush.exe) within the 'C:\Users\Public\Music\MusicLibrariesPackage' directory. This technique is used by threat actors, including APT37, to mask the execution of Python-based backdoors and evade detection.
Detects the execution of the Pester framework's Build.bat script, which is being abused as a LOLBAS (Living Off the Land Binary and Script) technique. This activity is typically characterized by being launched from an LNK file, often indicating a malicious dropper or secondary stage payload delivery.
Detects the mounting of Virtual Hard Disk (VHD) files using system processes such as explorer.exe or vds.exe. This activity is a known technique for bypassing Mark-of-the-Web (MOTW) security protections, as files within the mounted container may not inherit the MOTW attribute. This behavior was observed in Operation QUICSILVER, where actors used VHD files disguised with benign extensions to deliver malicious LNK payloads to targets.
Detects unauthorized modifications to the InprocServer32 registry key for the specific CLSID {2155fee3-2419-4373-b102-6843707eb41f}, a technique used by malware to achieve persistence by hijacking COM object instantiation to load a malicious DLL.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects the execution of PowerShell commands initiated from a .lnk file that query system information related to virtualization technologies (e.g., VMware, VirtualBox, Hyper-V) or hardware details (e.g., BIOS, VideoController). This pattern is often used for environmental awareness or anti-sandbox/anti-analysis techniques by malware.
Page 82 of 465