Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the use of certutil.exe to decode files located within directories associated with the MSSQL service account (e.g., AppData, ServiceProfiles). This behavior is characteristic of an attack chain where an adversary uses SQL Server's xp_cmdshell to stage and decode a malicious payload from a base64-encoded file.
This rule detects suspicious process lineage where a Python interpreter executes system commands indicative of a compromised or trojanized pandas package. Specifically, it identifies Python processes spawning command-line utilities for malicious shell operations (e.g., cmd.exe /c calc.exe on Windows or uname -a on Linux/macOS), suggesting an attempt to verify successful arbitrary code execution via a hijacked library function like read_json.
Detects a single source IP address attempting to connect to multiple hosts over TCP port 3389 (RDP) within a short timeframe (10 attempts in 60 seconds). This behavior is indicative of a host scanning the network for accessible RDP services, a common precursor to lateral movement or brute force attacks.
Detects high-frequency TCP connection attempts to WinRM (port 5985) originating from a single source host within the internal network. This pattern of behavior is often indicative of an adversary attempting to scan for or move laterally to multiple systems using WinRM.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to modify internal AMSI-related structures and memory flags (e.g., AmsiUtils, amsiInitFailed). This technique involves manipulating system objects to neutralize AMSI's ability to inspect malicious script content.
This rule detects potentially malicious POST requests to SharePoint endpoints (such as AddGallery.aspx) that include indicators of WebPartMarkup or ToolPane payloads. This activity attempts to bypass the SPUtility.EnsureAuthentication() check that is typically enforced on the ToolPane.aspx page, potentially allowing unauthorized code execution or configuration manipulation.
Detects anomalous access to the SharePoint WebPartPages.asmx SOAP endpoint, specifically using the GetWebPartPageConnectionInfo method. This query identifies patterns consistent with the exploitation of CVE-2026-65660, where adversaries attempt to smuggle WebPart template markup (e.g., <%@ Register, XamlServices) after legitimate preview methods have been disabled.
This rule detects artifacts and command-line patterns associated with Impacket utility suite modules, specifically wmiexec.py, smbexec.py, and secretsdump.py. These tools are commonly used by adversaries for remote command execution, lateral movement, and dumping of sensitive domain or system credentials.
Detects the suspicious execution of common Windows system binaries (LOLBAS) often used for proxying malicious code execution or deobfuscating payloads. This includes regsvr32.exe for remote scriptlet execution, mshta.exe for remote HTA execution, rundll32.exe for JavaScript or DLL function execution, and certutil.exe for decoding or retrieving remote files.
This rule detects potential Kerberoasting activity by monitoring Kerberos TGS requests (Event ID 4769) that use RC4 encryption (0x17 or 17). It identifies accounts requesting TGS tickets for a large number of unique Service Principal Names (SPNs), excluding requests for host-based services (ending in $). High volumes of such requests from a single user are indicative of an attempt to gather service tickets for offline password cracking.
This rule detects potential command-and-control (C2) activity by correlating the creation of known Cobalt Strike or Sliver framework named pipes with subsequent repeated HTTP/S network beaconing from the same process or host. The rule identifies processes establishing suspicious named pipes, then looks for persistent network connections to standard web ports (80, 443) within a 30-minute window, flagging instances where significant beaconing count is observed.
Detects the execution of Nova ransomware (formerly RALord) by monitoring for its specific modular command-line interface arguments, which include file encryption commands, ransom note deployment, and specific ransom note filenames. The rule monitors process creation events for strings like 'encrypt-all', 'encrypt-path', 'readme-add', '--workers', and the presence of the 'README_NOVA.me' ransom note or unique file extensions associated with its encryption activity.
Detects the execution of legitimate remote-access software commonly used in social engineering attacks, such as Quick Assist and AnyDesk. These tools are frequently abused as an initial access or persistence mechanism by threat actors following initial contact via methods like vishing or email-based social engineering.
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects the creation of scheduled tasks, recurring jobs, or webhook subscriptions by a user identity flagged as an AI_AGENT. This activity is monitored for persistence, especially when the event lacks a descriptive context or targets external networks, suggesting potential unauthorized agent behavioral drift or malicious persistence.
Detects unauthorized processes attempting to open handles to the Local Security Authority Subsystem Service (lsass.exe) with sensitive access rights (e.g., PROCESS_VM_READ, PROCESS_QUERY_INFORMATION). These access patterns are frequently utilized by credential dumping tools like Mimikatz, ProcDump, or malicious abuse of system utilities to extract plaintext passwords or NTLM hashes from memory.
Detects instances where one process initiates an injection mechanism (such as CreateRemoteThread, QueueUserAPC, or NtMapViewOfSection) into another process. The rule specifically alerts when these actions target common, high-value, or frequently abused processes such as explorer.exe, svchost.exe, or web browsers (chrome.exe, firefox.exe, msedge.exe), which are common targets for maintaining persistence or evading detection.
This rule detects the creation of scheduled tasks using either 'schtasks.exe' or PowerShell ('powershell.exe', 'pwsh.exe') with suspicious parameters. It flags tasks created in temporary directories (e.g., AppData, Temp, ProgramData, Windows\Temp) or tasks executed with 'highest' privileges or hidden configurations, often used for persistence or lateral movement.
Detects potential persistence mechanisms on Windows systems by monitoring for the creation or modification of Registry 'Run' or 'RunOnce' keys, as well as the creation of files within the Windows Startup folder. These actions are commonly used by adversaries to ensure malicious code executes automatically upon user login or system startup.
Detects potentially malicious PowerShell command-line activity by identifying patterns indicative of obfuscation, fileless execution, AMSI bypass, and downloading/executing remote payloads. The rule flags instances where long command lines are used with encoded flags, base64 decoding logic is paired with execution primitives, explicit AMSI bypass attempts, or combinations of encoded commands with web requests or hidden windows.
Page 95 of 1908