Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,534 detections
Filters
Last updated
All Time
Detection languages
2,471
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,439
11,829
5,873
5,151
4,864
4,534
Platforms
3,833
1,048
471
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,598
1,416
1,297
744
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects indicators of the PitScaler campaign targeting Citrix NetScaler ADC and Gateway appliances, exploiting vulnerabilities (CVE-2026-88771, CVE-2026-88772). It identifies the full attack chain including initial DTLS heap corruption exploitation, WHIPSHOT web shell C2 patterns, SLAPSHOT tunneling artifacts, web shell deployment files, httpd.conf PHP configuration tampering for persistence, privilege escalation via setuid /bin/sh modification, and anti-forensic log tampering.
Detects a potential web shell deployment by identifying a web server process creating or modifying a file in common web directory locations, followed shortly (within 10 minutes) by the execution of that same file.
Detects a suspected ClickFix social engineering attack where a user is tricked into pasting malicious commands into Windows Terminal, leading to a PowerShell download, followed by the appearance of specific known malicious artifacts (LockScreenContentServer.exe, dui70.dll, or 1.bat) within 15 minutes on the same device.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Detects a suspected ClickFix social engineering attack where a user is tricked into pasting malicious commands into Windows Terminal, leading to a PowerShell download, followed by the appearance of specific known malicious artifacts (LockScreenContentServer.exe, dui70.dll, or 1.bat) within 15 minutes on the same device.
Detects evidence of the SLAPSHOT backdoor on Citrix NetScaler appliances by identifying specific ephemeral IPC files (/tmp/.uxdport and /tmp/.uxdlock) or the associated python-based launcher process that uses base64-encoded arguments to initialize the proxy daemon.
Detects file system activity indicative of Royal and BlackSuit ransomware, specifically monitoring for the creation of ransom notes like 'README.TXT' or 'README.BlackSuit.txt' and mass renaming/encryption of files using extensions associated with these families (.royal, .royal_u, .blacksuit).
Detects instances where the IIS worker process (w3wp.exe) writes a new .aspx file into the 'MemberFiles' directory. This behavior is highly characteristic of webshell deployment following a successful file upload exploitation.
Detects the installation of unauthorized AI-related browser extensions followed by outbound network communication from the browser process to known external AI service API endpoints within one hour. This behavior is indicative of potential data exfiltration via shadow AI tools, bypassing standard enterprise DLP controls.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
Detects the 2CLoader malware dropping and executing a payload from user-writable directories such as Temp or Downloads. The rule identifies suspicious process lineage by checking for a parent-process spoofing scenario where the reported parent is explorer.exe, but the actual initiator is a different process, excluding common legitimate installer filenames to reduce noise.
Detects suspicious npm preinstall activity or node_modules execution patterns involving the execution of the Bun JavaScript runtime. This behavior is often indicative of supply chain compromise where malicious npm packages attempt to drop and run unauthorized binaries to facilitate secondary payload execution.
Detects a potential web shell deployment by identifying a web server process creating or modifying a file in common web directory locations, followed shortly (within 10 minutes) by the execution of that same file.
This rule performs a retrospective search across device file and network events for indicators of compromise associated with the UNC6240/ShinyHunters actor's activity against PeopleSoft, specifically linked to CVE-2026-35273. It monitors for known malicious file hashes (JSP webshells and executables), connections to known C2 infrastructure, and DNS lookups for specific malicious domains.
Hunting query, not intended as a scheduled alert.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Tested in a live Sentinel tenant with a test file. Copilot Cowork and Claude Code folder conventions not validated with live events; the Tool column is a label only and does not filter results. Matches files named SKILL.md in OneDrive and SharePoint only; local-only files and marketplace plugin skills are not visible.
Detects the execution of PowerShell with a bypass execution policy that performs a download or web request to save content to a file in the user's temp directory, followed by the immediate execution of that file. This pattern is characteristic of multi-stage malware droppers or fileless attack techniques attempting to stage and execute malicious scripts from temporary locations.
Detects the installation of unauthorized AI-related browser extensions followed by outbound network communication from the browser process to known external AI service API endpoints within one hour. This behavior is indicative of potential data exfiltration via shadow AI tools, bypassing standard enterprise DLP controls.
Detects suspicious behavior by the IIS worker process (w3wp.exe) indicative of web shell deployment, specifically the spawning of command interpreters (cmd.exe, powershell.exe) or the writing of .aspx files. This activity is consistent with exploitation campaigns targeting MOVEit Transfer, such as those conducted by the Lace Tempest (Cl0p) group.
The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security.
Detects a suspected ClickFix social engineering attack where a user is tricked into pasting malicious commands into Windows Terminal, leading to a PowerShell download, followed by the appearance of specific known malicious artifacts (LockScreenContentServer.exe, dui70.dll, or 1.bat) within 15 minutes on the same device.
Detects Impacket-style lateral movement patterns where system processes such as services.exe or wmiprvse.exe spawn command shells to copy files from a network share (UNC path) and execute them. This rule specifically looks for evidence of staging binaries or DLLs from remote shares, which is a common behavior of post-compromise frameworks like Impacket when performing 'hands-on-keyboard' actions.
Page 9 of 216