Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,116 detections
Filters
Last updated
All Time
Detection languages
6,549
6,199
1,473
1,002
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,567
3,899
1,465
1,391
1,330
Platforms
13,722
1,392
1,318
824
738
Products / Services
3,828
3,129
2,448
912
908
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects successful Palo Alto GlobalProtect VPN authentications where no Multi-Factor Authentication (MFA) challenge or related text is recorded in the firewall logs, and no corresponding successful MFA sign-in event is found in Entra ID (SigninLogs).
Detects potential DLL sideloading of mscoree.dll outside of standard system and .NET paths, followed closely by network activity connecting to GitHub from the same process within a one-hour window.
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Detects rundll32.exe executing inline JavaScript/VBScript via the
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects operator synchronization scripts (sync-all.sh, sync-memory.sh, sync-cc-users.sh) spawning SSH, rsync, or scp commands targeting AI-named jump-server accounts (claude, grok, gemini, glm).
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects a Python process spawning msiexec.exe followed by a high volume of LDAP connections (burst) from the same device within a 30-minute window, potentially indicating post-exploitation activity such as domain enumeration.
Box Shield Suspicious Location Access
Cortex XDR
Surfaces Box Shield suspicious location alerts with geographic context and accessed content details. Detects access from unusual or excluded geographic locations indicating potential compromised accounts or credential theft.
Detects the execution of rm commands using force flags to delete multiple critical appliance, system, and web server log files simultaneously on Linux hosts.
Detects cmd.exe executing a ping-based delay to loopback followed by self-deletion of the batch script (%~f0), as well as bulk deletion of common archive and executable files, typically associated with malware droppers like RareWolf.
Detects the writing and subsequent loading of driver files signed by a specific certificate holder (Wenjiang District Mingyu Network Technology), utilizing DeviceFileCertificateInfo, DeviceFileEvents, and DeviceImageLoadEvents.
Detects googleupdate.exe loading an unsigned DLL from a non-standard path, followed by network communication to a known Command and Control (C2) domain or IP address.
Detects instances where inst.exe running from C:\ProgramData\Intel with specific command-line arguments (extensionless and key-like) subsequently writes files to the EFI system partition or boot paths on the same device.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios
Browser sign-ins and MFA prompts with medium or high sign-in risk from devices that have no Entra device identity and are not managed or compliant. Hunting query, not an alert.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Page 3 of 863