Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,116 detections
Filters
Last updated
All Time
Detection languages
6,549
6,199
1,473
1,002
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,567
3,899
1,465
1,391
1,330
Platforms
13,722
1,392
1,318
824
738
Products / Services
3,828
3,129
2,448
912
908
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
Detektiert Gremlin Stealer TTPs wie Crypto-Clipping oder Session-Hijacking durch Analyse von verdächtigen Prozessbefehlen und Ressourcen-Manipulation laut Unit 42 Bericht.
Monitors Cisco Catalyst SD-WAN Controller logs for successful administrative logins. This may indicate exploitation of an authentication bypass vulnerability granting unauthorized admin access.
Linux SELinux Setenforce
Cortex XDR
Detects attempts to disable SELinux by executing the 'setenforce 0' command on Linux systems. Disabling SELinux can reduce the security posture of a system and is often performed by attackers to bypass security controls.
Detects the creation of an unexpected LaunchAgent property list named 'com.google.keystone.agent.plist' paired with the creation or execution of a binary at '~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate'. This exact path and plist combination is used by the SHub Reaper malware to establish persistent backdoor access while masquerading as a Google software update.
Detects possible MFA-approved session replay by identifying abnormal reuse of authenticated sessions across multiple IPs, browsers, and devices compared against a 14-day historical baseline. The rule prioritizes browser/device anomalies over geography since modern attackers often use same-country VPS/proxies.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Correlation rule that counts the events produced by Kubernetes Audit Event Deletion base rule
Detects make explicitly loading a Makefile from temporary or non-standard locations, often used to run arbitrary commands (due to writeable capability) via a trusted build utility.
Detects Microsoft 365 access attempts where the ClientAppId masquerades as Microsoft Office (d3590ed6-52b3-4102-aeff-aad2292ab01c) to bypass conditional access policies, but the UserAgent string reveals the use of a programmatic script (e.g., Python, PowerShell). This mismatch is a known tactic utilized by UNC6671 (BlackFile) during automated data exfiltration operations.
Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.
Systeminfo.exe Making Network Connection
Cortex XDR
Detects network connections originating from the systeminfo.exe process. This activity is suspicious because systeminfo.exe is a legitimate system enumeration tool not typically expected to initiate outbound network connections. This behavior has been observed in malware campaigns, such as CountLoader, which injects a cryptocurrency clipper into systeminfo.exe to communicate with C2 servers and the Ethereum blockchain.
Tycoon2FA Known Infrastructure Detection
Cortex XDR
This rule detects suspicious sign-in attempts to Microsoft 365 accounts that originate from known Tycoon2FA infrastructure. It specifically looks for device code flow authentications from IP addresses and Autonomous System Numbers (ASNs) associated with Tycoon2FA, combined with indicators like unmanaged/non-compliant devices, specific user agent patterns (axios, node, undici), and particular application IDs, and an unbound sign-in token protection status. This combination of indicators suggests an attempt to hijack Microsoft 365 accounts using device code phishing.
Detects abnormal MFA session behavior by monitoring user sessions with multiple IPs or browsers over 24h. Note: KQL 14-day historical baseline and set_difference logic is approximated.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Smartcard Disabled Event Detected
Cortex XDR
This rule detects when a smartcard is disabled, indicated by a specific change code (2060) in Windows raw event data. Disabling smartcards can be a tactic used by adversaries to bypass multi-factor authentication or other security controls.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects mount(8) bind operations from writable temp directories onto sensitive system subtrees, sometimes used to bypass integrity expectations or overlay binaries.
Detects the usage of certutil.exe to download files, or encode/decode data. This behavior is commonly associated with Living Off The Land Binaries (LOLBins) exploitation to bypass security controls.
Detects the creation of the specific named pipe 'GreenPlasmaSystemPipe' used for SYSTEM token impersonation. This is an explicit Indicator of Compromise (IOC) from the default GreenPlasma payload.
Detects unauthorized or unexpected modifications setting DisableLockWorkstation to 1 in the HKCU Policies path. This modification is explicitly used in the GreenPlasma exploit chain to retain interactive workstation access once SYSTEM execution is achieved.
Page 476 of 863