Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Detects usage of winget to add new additional download sources
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Detects usage of winget to add new potentially suspicious download sources
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
Detects PowerShell execution with suspicious Base64 decoding, commonly linked to malware installation
Detects when the macOS Script Editor utility spawns an unusual child process.
Hacktool Ruler
Sigma
This events that are generated when using the hacktool Ruler by Sensepost
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Detects execution of powershell scripts via Runscripthelper.exe
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
Detects PowerShell script execution via input stream redirect
Detects suspicious process related to rasdial.exe
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
Detects PowerShell execution with suspicious Base64 decoding, commonly linked to malware installation
This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.
Page 115 of 154