Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects two-stage phishing activity involving an initial visit to a Vercel-hosted lure page followed by the exfiltration or relay of fingerprinting and sandbox-evasion results to api.telegram.org.
Detects unauthenticated GET requests to known AI and machine learning infrastructure management endpoints (e.g., DCGM, Ray, Kubeflow) that are commonly exposed without authentication. These interfaces provide operational metrics, cluster status, or job management details, which can be leveraged for reconnaissance.
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
Detects the Sckit supply chain implant reading sensitive credential files from a user's home directory. The rule monitors processes spawned by Node.js or Python interpreters (the primary loaders for the Sckit worm) attempting to access high-value files like SSH keys, .npmrc, .pypirc, and various token storage files, indicating potential credential harvesting behavior.
Detects a multi-stage evasion sequence where a process first queries the system for virtualization or sandbox artifacts (e.g., VM tools, system information), followed by an intentional sleep or delay to bypass sandbox analysis, and concluding with subsequent process activity. This pattern is characteristic of malware attempting to detect and evade automated analysis environments.
Detects a multi-stage evasion sequence where a process first queries the system for virtualization or sandbox artifacts (e.g., VM tools, system information), followed by an intentional sleep or delay to bypass sandbox analysis, and concluding with subsequent process activity. This pattern is characteristic of malware attempting to detect and evade automated analysis environments.
Detects sophisticated in-memory loader activity characterized by a sequence of events: process module loads involving AMSI patching (amsi.dll), fresh ntdll.dll remapping to bypass EDR hooks, and the enumeration of hypervisor-related drivers or services, often associated with advanced payload execution chains like ClickFix.
Detects host-based reconnaissance activity involving system, network, and security software enumeration using standard administrative tools (e.g., PowerShell, WMI, netsh) that is followed by an outbound network connection to a known or suspicious implant check-in endpoint within a 30-minute window.
Detects the deployment of the CARBONATO botnet's Hermes Agent within containerized environments. The rule identifies specific artifacts such as the 'SOUL.md' persona configuration, 'netd-svc' container references, and indicators of AI-focused credential theft (e.g., searching for OpenAI or Anthropic API keys) orchestrated by the GH0ST AI agent.
This rule monitors for suspicious interactions with Android device drivers via the 'getevent' utility, often used to capture raw input, combined with unusual file access patterns involving 'locateValues.json' and potential data exfiltration attempts to specific internal API endpoints.
Detects a suspected anti-debugging and anti-instrumentation sequence on Android devices. This rule identifies instances where 'getprop' is used to query system properties related to device security (ro.debuggable, ro.secure) followed shortly by a local network probe to the standard Frida instrumentation server port (27042). This combination is indicative of malware gating its execution to ensure it is not running within a controlled or debugged environment.
Detects a suspected anti-debugging and anti-instrumentation sequence on Android devices. This rule identifies instances where 'getprop' is used to query system properties related to device security (ro.debuggable, ro.secure) followed shortly by a local network probe to the standard Frida instrumentation server port (27042). This combination is indicative of malware gating its execution to ensure it is not running within a controlled or debugged environment.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
The FileFix StealC campaign's final-stage loader is written in Go and performs VM/sandbox checks plus string encryption before executing the infostealer.
This rule detects potentially malicious search activity in Microsoft SharePoint by monitoring for high-frequency queries that include specific site class patterns ('STS_Site' or 'STS_Web') and a document ID range search pattern ('indexdocid'). This behavior is characteristic of an adversary attempting to enumerate or scrape documents within a SharePoint environment.
Detects the ChainScript RAT agent (executing as node.exe from specific masquerading directory paths) scanning for and enumerating cryptocurrency wallet files, browser-stored wallet extensions, and related sensitive configuration data.
Detects automated reconnaissance using WMI or PowerShell to perform broad queries for system environment, security products, network adapters, software, and hardware attributes. The detection focuses on clusters of distinct WMI reconnaissance categories occurring within a 15-minute window, which is often indicative of pre-C2 profiling by adversaries.
Detects automated reconnaissance using WMI or PowerShell to perform broad queries for system environment, security products, network adapters, software, and hardware attributes. The detection focuses on clusters of distinct WMI reconnaissance categories occurring within a 15-minute window, which is often indicative of pre-C2 profiling by adversaries.
This rule monitors for suspicious command-line activity involving the Fortis payment processor's webhook log files. It detects when attackers use tools like 'findstr', 'cmd', or 'dir' to navigate directories containing webhook data and specifically searches for payment card fields such as CVV, primary account numbers, and expiration dates, which is a common indicator of post-compromise data exfiltration.
Detection of common web server reconnaissance, enumeration, and brute-force patterns targeting IIS environments. This includes detection of short-name (~1) probes, WebDAV method usage, NTFS alternate data stream requests, and brute-force attempts on login endpoints originating from PowerShell user agents.
Detects high-volume, rapid enumeration of core Microsoft Graph directory endpoints (users, groups, applications, and servicePrincipals) by a single identity or session. This behavior is indicative of reconnaissance tools such as AADInternals, ROADtools, or TokenTactic being used to map out a cloud environment's directory structure.
Page 11 of 203