Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects processes that are taking an unusually high number of screenshots within a defined timeframe. It identifies screenshot activity by looking for specific action types like "ScreenshotTaken", file creations with common image extensions (.png, .jpg, .jpeg, .bmp, .gif, .tiff), and process command lines containing common Windows API calls related to screen capturing (e.g., BitBlt, GetDC, PrintWindow, CopyFromScreen). The rule aggregates these events per device and triggers an alert if the total number of screenshots exceeds a configurable threshold.
This rule detects attempts by scripting language interpreters (Node.js, Python, PowerShell) to access sensitive browser credential files such as 'Login Data', 'Web Data', and 'Cookies' from Chrome and Brave browser user data directories. It also includes specific file paths that might be associated with known browser extensions or malware that target these files. This activity is indicative of credential dumping or information stealing.
This rule detects files associated with Qilin (aka Agenda) ransomware based on known malicious file hashes. It monitors for file creation or process execution events where the SHA1, SHA256, or MD5 hash matches a predefined list of Qilin ransomware hashes.
This detection identifies processes that have executed on a host in the last 7 days but were not observed in the previous 30 days. This is useful for detecting potentially malicious or anomalous activity, such as new software installations, LOLBins, or attacker tools introduced during a compromise.
This rule detects potential data exfiltration attempts using the built-in Windows `ping.exe` utility. Specifically, it looks for `ping.exe` executions where a large payload size (greater than 1024 bytes) is specified using the -L command-line argument. This technique can be used to tunnel data over ICMP, which might bypass some network defenses.
Detects potential_APT-style process hollowing on Linux using syscall stubs and string camouflage
This rule detects the execution of known Remote Monitoring and Management (RMM) tool processes or network connections to domains associated with RMM tools. It leverages an external CSV file containing a list of RMM tool executable names and their associated domains to identify suspicious activity. The rule aims to identify the presence and use of legitimate RMM software, which can be abused by adversaries for remote access and control.
This detection identifies known malicious file hashes associated with SharePoint exploitation campaigns. These hashes correspond to web shells and post-exploitation tools observed in attacks by threat actors like Storm-2603.
This detection rule identifies processes that call the 'GlobalMemoryStatusEx' Windows API. This behavior is a known sandbox evasion technique used by malware, including SLOW#TEMPEST, to check the system's physical memory size before executing a malicious payload. The rule is tuned to focus on unsigned processes or those running from non-standard locations and with low host prevalence.
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.
This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.
Looking for processes executing chrome / edge with a remote debugging port, this is typically seen being leverage by info stealer malware to steal credentials.
The remote debugging functionality can be used to obtain cookies without requiring keychain access.
The remote debugging functionality can be used to obtain cookies without requiring keychain access.
This rule detects the presence of specific file hashes (MD5, SHA1, SHA256) across device file events, device process events, and email attachment information. It is designed to identify known malicious files or indicators of compromise (IOCs) within an environment.
SMBExec was Used
S1QL
Detects potential attempts to access administrative shares using cmd.exe or powershell.exe, which could indicate lateral movement or unauthorized access attempts.
KQL Query from file: PowerShell-Based Event Log Clearing
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query
KQL Query
Page 77 of 84