Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects when the Internet Information Services (IIS) worker process (w3wp.exe) accesses sensitive files such as 'web.config', 'applicationHost.config', or 'win.ini'. Unauthorized access to these files by the IIS process can be an indicator of a web shell or other malicious post-exploitation activity attempting to steal credentials, application secrets, or system configuration information.
Detects cloud searches for sensitive keywords (credential, secret, etc.) followed by access to matching files.
Detects rapid screenshot capture and image encoding by a non-support process for live remote viewing, indicative of a Remote Access Trojan (RAT) like Banana RAT. The rule specifically looks for process command lines containing functions related to screen capturing (CopyFromScreen, BitBlt, Graphics.CopyFromScreen) and image encoding/streaming (JPEG, Bitmap, stream, frame, socket).
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
Detects attempts to leverage PowerShell to register a loose-file AppX package from a UNC path. This technique can be used to trigger NTLM coercion via InstallService.exe or achieve SYSTEM DLL load, often associated with the 'UNCanny' coercion method. The rule looks for PowerShell command lines containing 'Add-AppxPackage', '-Register', and a UNC path (\\) along with 'AppxManifest.xml'. Additional suspicious indicators like '-ExecutionPolicy Bypass', 'DiscCoerceProbe', 'poc.ps1', 'Invoke-InstallServiceCoerce.ps1', or '-AttackerHost' increase the suspicious score.
Detects suspicious activity indicative of CryptoBandits malware, specifically JScript stealer polling the clipboard and beaconing actions. This rule identifies instances where wscript.exe or cscript.exe spawn clip.exe (for clipboard access), curl.exe (for C2 communication via Tor SOCKS5 with specific keywords like 'REPL', 'SEED', 'PKEY'), or cmd.exe within a staging directory like 'Public\Documents'. It also looks for specific filenames in the command line such as 'exefu.js', 'ofolu.js', 'words.txt', or 'ugate.exe'.
Detects activity associated with Operation Poisson credential theft, specifically the use of VBScript (sys.vbs) to launch a Python keylogger (pynput or keyboard library) or the installation of keylogger dependencies via pip. It also includes a hash match for a known artifact (KeyL.zip).
Detects a high number of office, PDF, text, and archive files created or renamed in the Downloads or AppData Roaming folders by a single process within a fifteen-minute window. The detection is triggered if either 25 or more files are created/renamed, or if the total size of these files exceeds 500 MB.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
This rule detects processes that load sensitive Windows multimedia and graphics modules (mmdevapi.dll, avrt.dll, magnification.dll, dxgi.dll) which are commonly utilized for audio recording and screen capturing. The rule filters out known legitimate applications (e.g., Teams, Zoom, Web browsers) and trusted software publishers. It further identifies potential suspicious activity by flagging processes originating from common staging paths like 'Temp', 'Downloads', or 'ProgramData' and instances where the process image is unsigned.
This rule detects potential Animateclipper malware or similar cryptocurrency clipboard hijackers by identifying the presence of Windows API calls related to clipboard manipulation (GetClipboardData, SetClipboardData) in conjunction with regular expressions for common cryptocurrency addresses (Bitcoin, Ethereum) and the keyword 'clipboard'. The rule triggers if at least three of these indicators are present, suggesting an attempt to monitor and replace cryptocurrency addresses copied to the clipboard.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
This rule detects potential mass email collection activity over IMAP (port 143). It triggers when a client sends a 'FETCH' command followed by 'BODY[]' content at least 20 times within 60 seconds from the same source IP address. This behavior is indicative of an adversary attempting to download a large number of email bodies, which is a common method for email collection.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is associated with the 'protocal.cjs' backdoor from the easy-day-js supply chain attack, which aims to exfiltrate sensitive browser data.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Identifies the AMOS stealer validating and redirecting the captured plain-text macOS password into a hidden .pass file.
Time-series correlation identifying the powershell process rapidly scraping browser extensions and local storage files. This rule detects suspicious file access patterns where a process rapidly accesses multiple files within browser-related folders (Local Extension Settings, Network Persistent State, Cookies, Login Data). A count of more than 5 unique file accesses within a one-minute window by the same process on the same device triggers the alert.
This rule correlates the credential scraping phase with the invocation of zip, tar, or ditto to compress stolen artifacts into a single file in the /tmp directory. Specifically, it looks for these archiving utilities being executed with a command line that targets a .zip or .tar.gz file within /tmp, and joins this activity with the prior access of a file named 'Login Data' by the same initiating process.
Detects the loading of DLLs from suspicious locations such as AppData, Temp, or ProgramData into common browser processes. This activity is often associated with process injection techniques like Cobalt Strike's keylogging jobs or other credential theft attempts.
Page 109 of 173