Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,057 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,110
9,757
3,852
3,759
3,713
Platforms
40,057
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,879
MITRE Techniques
13,737
13,117
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects NTLM network logons (LogonType 3 or 9) which often result from a host resolving an attacker-supplied UNC path (e.g., \host
esource) during forced authentication attacks. This rule monitors Windows Security Event ID 4624 to identify incoming NTLM-based network authentication requests, excluding local system logons.
Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments.
Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update.
Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.
Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update.
Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.
Detects the execution of the 'gitshot' binary, which is known to automatically create public repositories and release tags to host screenshots or screen recordings. This behavior can be abused by insiders or attackers to exfiltrate sensitive data outside of corporate control.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects the creation, modification, or renaming of common JSP web shell filenames (x.jsp, u.jsp, u2.jsp) within known web application directories (e.g., webapps, Peoplesoft, WebLogic). This pattern is indicative of an adversary attempting to establish a web shell for persistent access or command execution on a vulnerable web server.
Detects execution of MeshAgent binaries when initiated by common scripting or application processes (e.g., java, sh, bash, python) or when displaying suspicious command-line patterns indicative of unauthorized remote access or download activity, particularly in environments like WebLogic or PeopleSoft.
This rule performs an indicator of compromise (IOC) hunt for artifacts related to the Lazarus Group's Graphalgo/GHAPPIER campaign. It monitors DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents over the past 90 days to identify matches against known malicious file hashes (SHA256/SHA1), command-and-control (C2) IP addresses, and malicious domains associated with this campaign.
This rule performs an indicator of compromise (IOC) hunt for artifacts related to the Lazarus Group's Graphalgo/GHAPPIER campaign. It monitors DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents over the past 90 days to identify matches against known malicious file hashes (SHA256/SHA1), command-and-control (C2) IP addresses, and malicious domains associated with this campaign.
This rule performs an indicator of compromise (IOC) hunt for artifacts related to the Lazarus Group's Graphalgo/GHAPPIER campaign. It monitors DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents over the past 90 days to identify matches against known malicious file hashes (SHA256/SHA1), command-and-control (C2) IP addresses, and malicious domains associated with this campaign.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
This rule detects the execution of common tools and commands used to perform Kerberoasting, a technique where attackers request Kerberos service tickets for user accounts with Service Principal Names (SPNs) in order to perform offline brute-force attacks to recover plaintext credentials. The rule specifically monitors process creation events for known offensive security tools like Rubeus, as well as specific command-line arguments for 'setspn.exe' and various scripts that can be used to identify potential Kerberoasting targets.
Detects the use of legitimate Windows binaries (certutil.exe and bitsadmin.exe) to download files from remote URLs or perform encoding/decoding operations in suspicious directories (Temp, AppData). This activity is commonly used by adversaries for stage-one malware delivery or tool ingress.
Detects instances of rundll32.exe or regsvr32.exe executing from suspicious locations or with suspicious command-line arguments (e.g., URLs, JavaScript, or script file extensions) initiated by an unsigned process. This is a common technique used to proxy malicious code execution while evading security monitoring.
This rule detects common Cobalt Strike malleable profile named pipe creation events as well as network connections initiated by common LOLBins (Living Off the Land Binaries) that are unsigned, which is a common indicator of beaconing activity.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Detects the execution of script files with .js or .se extensions using wscript.exe or cscript.exe outside of standard system directories. This behavior is consistent with the More_eggs JScript backdoor, which has been utilized by the FIN6 threat group (also known as Skeleton Spider) to establish persistent backdoors for follow-on payload delivery.
Detects the use of PowerShell to modify Windows Defender settings (e.g., disabling real-time monitoring, adding exclusions, or stopping services) using the Set-MpPreference cmdlet or service control commands. This technique is frequently utilized by ransomware actors, such as the ALPHV/BlackCat group, to neutralize security protections prior to executing malicious payloads.
Detects the installation or execution of common Remote Monitoring and Management (RMM) tools, including AnyDesk, ScreenConnect, and TeamViewer, by monitoring process creation events. This behavior is indicative of social-engineering-based intrusions by the Scattered Spider (UNC3944/Octo Tempest) threat actor, who often impersonates IT support staff to convince users to run these tools for unauthorized remote access.
Page 97 of 1908