Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects suspicious process related to rasdial.exe
Detects a suspicious script execution in temporary folders or folders accessible by environment variables
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Detects PowerShell download and execution cradles.
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Detects triggering of AMSI by Windows Defender.
Detects actions taken by Windows Defender malware detection engines
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Detects Wscript or Cscript executing from a drive other than C. This has been observed with Qakbot executing from within a mounted ISO file.
'This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.'
Lazarus Loaders
Sigma
Detects different loaders as described in various threat reports on Lazarus group activity
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within
the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate
command-and-control server.
the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate
command-and-control server.
Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Detects suspicious parent process for cmd.exe
Detects execution of powershell scripts via Runscripthelper.exe
Use of OpenConsole
Sigma
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Page 139 of 154