Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects correlation between directory or path discovery commands (such as net use, net view, Get-ChildItem, OneDrive, robocopy) and significant file staging activities involving document or archive files created within Downloads or AppData\Roaming subdirectories on the same device within a 1-hour window.
Detects a sequence where a remote-support or screen-share tool (such as Quick Assist or mstsc.exe) is launched followed by the execution of a commercial Remote Monitoring and Management (RMM) agent (such as AnyDesk, Bomgar, Zoho Assist, or SuperOps) on the same device within a 2-hour window. This pattern is commonly associated with vishing and initial access tactics used by threat actors like UNC3753.
Detects a sequence where a ZIP file from known lure repositories or names is downloaded, followed within a day by the execution of a LuaJIT binary (util64.exe or luajit.exe) via a script launcher (Application.bat or Launcher.cmd) using obfuscated text files.
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects LegionLoader (Satacom/CurlyGate) malware communicating with command and control servers via HTTP POST requests to /nfront.php or /nback.php, or via form-urlencoded POST requests originating from non-browser executables using WinHTTP.
Detects when an account reads a Local Administrator Password Solution (LAPS) password attribute and subsequently modifies the resource-based constrained delegation (msDS-AllowedToActOnBehalfOfOtherIdentity) attribute within a 4-hour window, which may indicate privilege escalation activity.
Detects mass creation or renaming of files with the .L0CK3D extension (associated with C3RB3R / eCh0raix ransomware) within a short timeframe across multiple folders, optionally correlated with the creation of the read-me3.txt ransom note.
This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
Detects a staged execution sequence on a single device within a 30-minute window involving ftp.exe fetching an icon or resource file, optional schtasks creating a task, curl.exe downloading an MSI, and msiexec.exe installing the MSI.
Detects a suspicious execution chain where a LNK file executed from a mounted VHDX launches cmd.exe, opening a decoy .xls/.xlsx file while simultaneously launching a silent MSI installation using msiexec.
Detects a sequence where a process fetches a file containing 'talk.log' or 'techtalkhelp', followed within 15 minutes by the same device executing PowerShell with Base64 decoding flags.
Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
Detects potential suspicious winget package installation from a suspicious source.
Detects the creation of files with scripting or executable extensions by Mysql daemon.
Which could be an indicator of "User Defined Functions" abuse to download malware.
Which could be an indicator of "User Defined Functions" abuse to download malware.
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects a non-standard process accessing Swarm cryptocurrency wallet files (swarm.key or config.yaml) followed within one hour by network connections to a known C2 domain (frameworkmetrics.xyz). It filters out routine access based on baseline activity.
Dual-use transfer tools (rclone, WinSCP, curl, AzCopy, AWS/gcloud CLI) are favored by ransomware affiliates and APT operators because they are signed/legitimate. The hunt keys on upload-oriented flags and verbs per tool, not binary presence. Each tool has its own
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Page 9 of 2907