Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,764 detections
Filters
Last updated
All Time
Detection languages
3,724
2,041
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,231
485
Categories
5,723
3,080
1,138
901
659
Platforms
9,650
659
432
53
30
Products / Services
10,704
9,764
6,706
4,421
3,752
MITRE Techniques
3,828
3,377
1,982
1,618
1,042
CVEs
18
14
12
12
11
Detects the execution of PowerShell encoded commands that result in the installation of known remote monitoring and management (RMM) software. This pattern is indicative of attackers, specifically those associated with Ransom Busters or similar affiliates, establishing persistent remote access to compromised systems.
Detects the execution of the SoftPerfect Network Scanner tool (netscan.exe), which is often used by adversaries for reconnaissance to identify active hosts, open ports, and services within a network.
Detects the creation or modification of Windows Scheduled Tasks involving system-level components. The rule monitors modifications to the TaskCache registry keys specifically containing 'System' or the creation of task files in the System32 directory. It excludes trusted processes like msiexec.exe and trustedinstaller.exe, which are typically responsible for legitimate system updates or installations.
Detects the execution of PowerShell or Rundll32 processes with command-line arguments that reference Anti-Malware Scan Interface (AMSI) components. This is a common indicator of an attempt to bypass or disable AMSI to facilitate the execution of malicious scripts or payloads.
Detects instances where specific suspicious or known-malicious processes load 'ntdll.dll' from the 'System32' directory. This behavior is indicative of potential DLL side-loading, process injection, or evasive execution patterns where an attacker leverages legitimate system binaries to load malicious code.
Detects suspicious command-line entries within the Windows RunMRU registry key, which logs recently executed commands from the Run dialog (Win+R). This detection targets common ClickFix or copy-paste attack patterns, specifically identifying the presence of 'powershell', 'curl', or long base64-encoded strings.
Detects suspicious processes attempting to open security-critical DLLs like amsi.dll or ntdll.dll with potential write or execute access. This behavior is often associated with runtime patching techniques used to disable or evade AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) monitoring, which are common defensive evasion tactics.
Detects DNS resolution requests to 'graph.microsoft.com' on endpoint devices. This is intended to act as a precursor indicator for potential Microsoft 365 or Azure environment enumeration and discovery activities, which would typically involve subsequent API calls.
Detects mass file renaming activity associated with OpnKey ransomware, which appends specific ransom identifiers to files. This behavior is indicative of the encryption phase of a ransomware attack, where files are renamed to reflect the encryption status or to include a unique victim identifier.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
The following analytic correlates modifications to the Windows RunMRU registry key with clipboard content
changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied
from a browser are subsequently executed on the Windows system through the Run dialog box.
changes initiated by browsers. It aims to detect ClickFix scenarios in which commands copied
from a browser are subsequently executed on the Windows system through the Run dialog box.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Bigbear V2 Ioc Hunt
Sigma
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
Detects the loading and service creation of the CcProtect/Alinubx kernel driver, a known technique for Bring Your Own Vulnerable Driver (BYOVD) attacks. The rule identifies suspicious characteristics such as file name mismatches, unauthorized product/company signatures, and the creation of services associated with this malicious driver family (e.g., NvFsFilter) to facilitate EDR/AV termination or privilege escalation.
This rule detects the potential use of parent process spoofing (PPID spoofing) where a PowerShell process is spawned with 'explorer.exe' as its parent. This technique, often executed via the 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' attribute in a 'CreateProcessW' call, is used by adversaries to mask the true origin of the PowerShell process and evade behavioral detection.
Detects unauthorized access attempts to browser credential files (such as Login Data, key4.db, and cookies) by non-browser processes. This behavior is indicative of the Rapuncel infostealer, which harvests stored browser credentials after attempting to disable or bypass security solutions.
Detects unauthorized access attempts to browser credential files (such as Login Data, key4.db, and cookies) by non-browser processes. This behavior is indicative of the Rapuncel infostealer, which harvests stored browser credentials after attempting to disable or bypass security solutions.
Detects the ClickFix social-engineering pattern where a user is tricked into pasting and executing a command, typically via the Windows Run dialog (explorer.exe), that triggers the command shell (cmd.exe or powershell.exe) to utilize finger.exe or curl.exe for downloading and staging malicious payloads like CastleRAT.
Page 91 of 465