Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,586 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
The analytic detects the creation of a new scheduled task with the highest execution privileges via Schtasks.exe. It leverages Endpoint Detection and Response (EDR) logs to monitor for specific command-line parameters ('/rl' and 'highest') in schtasks.exe executions. This activity is significant as it is commonly used in AsyncRAT attacks for persistence and privilege escalation. If confirmed malicious, this could allow an attacker to maintain persistent access and execute tasks with elevated privileges, potentially leading to unauthorized system access and data breaches.
This detection identifies instances where the ESXi UI is accessed using the root account from an external IP address. Direct root access to the UI bypasses role-based access controls and auditing practices, and may indicate risky behavior, misconfiguration, or unauthorized activity by a malicious actor using compromised credentials.
Detects Microsoft Entra ID sign-in events where a user principal authenticates using a refresh token issued to the Microsoft Authentication Broker (MAB) client, targeting the Device Registration Service (DRS) with the "adrs_access" OAuth scope. This pattern may indicate token-based access to DRS following an initial authorization code phishing or as a precursor to malicious device registration using tools like ROADtx.
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.
This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
Detects TTPs associated with the HazyBeacon backdoor, used by the threat cluster CL-STA-1020. This rule identifies the creation of a specific persistence service and the execution of custom exfiltration tools from the C:\ProgramData directory. This threat also uses C2 communication via AWS Lambda URLs (e.g., *.lambda-url.*.on.aws) from the mscorsvw.exe process, which should be monitored via network logs.
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
Detects the creation of hidden configuration files or a LaunchDaemon plist file used by the Odyssey Stealer malware to establish persistence on a compromised macOS system.
Detects Matanbuchus malware loader IOCs including file hashes, a scheduled task name, domains, and an IP address.
The analytic detects the use of 'schtasks.exe' to create a scheduled task on a remote system, indicating potential lateral movement or remote code execution. It leverages process data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line arguments and flags. This activity is significant as it may signify an adversary's attempt to persist or execute code remotely. If confirmed malicious, this could allow attackers to maintain access, execute arbitrary commands, or further infiltrate the network, posing a severe security risk.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
This rule detects suspicious creation or modification of Windows Scheduled Tasks via direct changes to the Registry, as captured by Sysmon Event IDs 12, 13, and 14. Adversaries often use this technique to establish persistence by creating malicious tasks that run at system startup or on a scheduled basis. The rule monitors the TaskCache registry paths specifically Tasks and Tree keys and excludes known legitimate operations by trusted system processes and users (e.g., taskhostw.exe, svchost.exe, SYSTEM, and service accounts) to reduce false positives.
Detects a wide range of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with SafePay ransomware, including specific command lines, persistence mechanisms, defense evasion techniques, and host-based artifacts.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
Detects HTTP POST requests containing suspicious parameters or headers used by GoldMelody's in-memory IIS modules. Attackers leverage ASP.NET ViewState deserialization to execute payloads in memory, often passing commands and data via non-standard HTTP parameters and headers within POST requests.
Detects TTPs associated with the HazyBeacon backdoor, which has been observed targeting governmental entities in Southeast Asia. This rule identifies specific service creation for persistence, DLL sideloading of mscorsvc.dll, C2 communication via AWS Lambda URLs, and execution of known exfiltration tools from the C:\ProgramData directory.
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
Hypothesis: An adversary who has successfully phished a user for an OAuth authorization code or refresh token may use it in a non-interactive sign-in to abuse trusted first-party Microsoft applications for persistence or data exfiltration.
This rule detects two primary scenarios observed in such campaigns:
1. A refresh token issued to the Microsoft Authentication Broker is used to access the Device Registration Service (DRS) with the 'adrs_access' scope. This is indicative of an adversary registering a new device to gain persistence via a Primary Refresh Token (PRT).
2. A token is used by the Visual Studio Code application to access the Microsoft Graph API. This can be used by an attacker who has phished an authorization code to exfiltrate data like emails.
This rule detects two primary scenarios observed in such campaigns:
1. A refresh token issued to the Microsoft Authentication Broker is used to access the Device Registration Service (DRS) with the 'adrs_access' scope. This is indicative of an adversary registering a new device to gain persistence via a Primary Refresh Token (PRT).
2. A token is used by the Visual Studio Code application to access the Microsoft Graph API. This can be used by an attacker who has phished an authorization code to exfiltrate data like emails.
This rule detects the execution of common Windows utilities (PowerShell, Regsvr32, BITSAdmin, Certutil, MSHTA) when initiated by a web browser. This behavior can indicate an attempt to execute malicious code or download additional payloads after a user clicks a malicious link or visits a compromised website. Adversaries often leverage these utilities for various purposes, including code execution, file transfer, and bypassing security controls.
Page 465 of 600