Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects use of forged web cookies for bypassing authentication
Detects fake Windows authentication prompts used to capture credentials
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule identifies the use of xcopy.exe with a combination of flags (/s, /e, /y, /c, /q, /h, /b) that are characteristic of NarwhalRAT's data staging activities from removable media.
Detects bulk file reading from network shares for data collection
Detects malicious script injection into HTTP responses via MitM
Detects unauthorized DHCP server responses indicating potential network compromise
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.
Detects the archiving (tar or zip) of .git directories. This activity can indicate an adversary attempting to exfiltrate full source code history and internal intellectual property.
Detects an untrusted process creating WAV or compressed audio files in a temporary path after loading multimedia capture components. This behavior is indicative of potential audio surveillance or data collection.
Monitors the Node package manager engine performing mass file reads of all .pub files in the SSH keys path. This rule specifically looks for 'node.exe' accessing multiple files ending with '.pub' within folders containing '.ssh'.
Detects PowerShell utilizing .NET Graphics classes to perform screen capture, specifically looking for the use of 'System.Drawing.Graphics', 'CopyFromScreen', and 'Bitmap' in the process command line.
Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.
Detects the extraction of a ZIP archive via tar.exe to the %TEMP% directory. This activity is often associated with malware unpacking or staging, where an adversary extracts malicious content into a temporary location for execution.
Detects unauthorized access to manufacturing process historian databases (OSIsoft PI, Honeywell PHD, Aspen IP.21) by non-engineering accounts from unexpected workstations. The rule correlates audit logs showing access to historian systems with sign-in logs for specific applications, identifying users with a high volume of access within a short timeframe.
This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.
Detects bulk cloning of GitHub repositories for source code collection
This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.
Identifies network connections to specific Azure-hosted authentication brokers used by the jupyter-powerdev malware to retrieve Graph API tokens for its SharePoint C2 channel. This rule specifically looks for connections to known malicious broker domains or a known associated IP address.
Detects copying of Outlook PST/OST files for email collection
Detects access to clipboard data for credential or data capture
Page 117 of 173