Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
This query uses the Machine Learning series_decompose_anomalies function to build a baseline of "normal" transport rule modification behavior. If your organization typically changes 0 rules a week, and suddenly 5 are changed at 2 AM on a Saturday, this query will catch it regardless of what the parameters are.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
This rule detects chat or call activity by external users in Microsoft Teams whose source tenant is not present in a pre-defined whitelist. This could indicate unauthorized external communication or potential data exfiltration attempts.
Detects unauthorized access to decoy files (canary files) placed in strategic locations. By monitoring for access to files with enticing names (e.g., 'passwords.xlsx'), organizations can identify file discovery and data staging activities. Any access to these files is highly suspicious as they have no legitimate purpose. Walkthrough for the creation of Canary Files can be found here: https://github.com/fluffybunnies-h4x/CyberDeception?tab=readme-ov-file#canary-files
Detects when a new Multi-Factor Authentication (MFA) method is registered shortly after a successful sign-in from an unfamiliar or risky location. This pattern is a strong indicator of an Adversary-in-the-Middle (AiTM) attack where the threat actor, having bypassed MFA to gain initial access, immediately adds their own authentication method to establish persistence on the account.
This rule detects instances where a SharePoint or OneDrive file/folder is shared with a guest user whose email address is identified as a threat intelligence indicator. This could indicate an attempt to exfiltrate data to a known malicious entity or an account compromise being used for data staging.
This rule detects suspicious activity related to browser credential theft or staging. It triggers when a non-browser process accesses sensitive browser files (like 'Login Data' or 'Local State') or when temporary artifacts associated with credential stealer activity ('chromeTmp', 'Local State-journal') are created. This behavior is indicative of an attacker attempting to exfiltrate browser-stored credentials.
Detects tar.exe being spawned by processes commonly associated with initial access or lateral movement, such as web servers or remote management services. This activity is highly indicative of post-exploitation activity like data staging.
This rule detects behaviors associated with HoneyMyte post-exploitation scripts. Specifically, it looks for `curl.exe` or `curl` being used to download executables or files into 'Libraries' or 'Public' directories. It also identifies executables named `getlogindata.exe` or `getlogindataedge.exe` when their command line arguments contain 'Login Data' or 'Local State', indicating browser credential theft. Additionally, it detects `powershell.exe` or `cmd.exe` command lines that include keywords related to HoneyMyte's exfiltration methods (e.g., 'pixeldrain', 'PIXELDRAIN', '113.23.212', 'log.dat', 'nbtscan').
This rule detects the XenoRAT info stealer and Remote Access Trojan (RAT) by identifying specific strings related to its functionalities. It looks for configuration parameters like 'HostName', 'PortNumber', 'UserName', and 'Password' which are typically supplied at runtime for C2 communication. The rule also identifies strings associated with browser data exfiltration ('Local Extension Settings', 'Sync Extension Settings', 'chromium_plugins', 'logins.json', 'profiles.ini', 'IndexedDB', 'chrome-extension_'), crypto wallet theft ('ChainingModeGCM'), file grabbing capabilities ('%DRIVE_FIXED%', '%DRIVE_REMOVABLE%', 'File Grabber'), and HVNC-style desktop control ('Chrome_WidgetWinOperaWindowClass', 'CreateDesktopA', 'OpenDesktopA'). Additionally, it includes specific hashes of known XenoRAT samples for direct identification.
Detects file activity associated with the VIMC UNITY trojan. The rule identifies two main behaviors: (1) a process running from common temporary or user data directories (Temp, AppData, ProgramData, Downloads) creating or writing to a file named 'logs.txt'; and (2) the creation of 'XClient.exe' or 'shost.exe' within Temp, AppData, or ProgramData directories. This rule can serve as a supporting indicator and should ideally be correlated with other VIMC UNITY detection rules for higher confidence.
Detects execution of XenoRAT, an information stealer and remote access trojan targeting browser data, cryptocurrency wallets, file systems, and HVNC style remote desktop activity. Command and control parameters including hostname, port, username, and password are supplied at runtime. Detection uses known hashes and behavioural context, with higher confidence achieved by correlating with xenorat_stealer_file_access on the same host within 15 minutes.
Detects the execution of the native Windows tar.exe utility to create archives of sensitive files or directories. This behavior is often associated with data staging for exfiltration.
Detects XenoRAT command and control information stealer file access activity. XenoRAT reads browser profile data, including logins.json, Web Data, Cookies, Local Extension Settings, chromium_plugins, and profiles.ini, as well as cryptocurrency wallet files such as _key.txt, _v20.txt, and directories under Wallets. The detection triggers when a process executing from a writable or temporary path, or matching known XenoRAT hashes including MalwareBazaar samples and the UPX packed variant bb7f5743, accesses these paths under AppData or ProgramData. For higher confidence, correlate with xenorat_execution on the same host.
Detects the execution of the native Windows tar.exe utility with flags that redirect the output to standard output (stdout) instead of a file. This behavior can indicate data being staged for exfiltration or piped to another tool for in-memory execution, bypassing file-based detections.
Detects when the Windows Admin Center service ('SmeSvc.exe') is stopped, and shortly thereafter, a different process starts listening on the WAC port (TCP/6516). This behavior is a key indicator of CVE-2026-20965 exploitation, where an attacker impersonates the service to steal administrator access tokens.
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of unique mailboxes belonging to other users. 2) Identifies users accessing a high number of unique folders within another user's mailbox. Both scenarios can indicate unauthorized access, data exfiltration attempts, or compromised accounts.
This rule detects the presence or execution of known malicious infostealer files based on their SHA256 hash values or a specific filename pattern. The SHA256 hashes are associated with infostealer malware as referenced in a VirusTotal blog post. The filename pattern 'malwarebytes-windows-github-io' also indicates potential malicious activity, likely related to a deceptive download or execution.
This rule detects potential credential harvesting and cryptocurrency wallet theft activities, specifically targeting browser data, SSH keys, cloud credentials, and crypto wallets. It looks for command-line patterns indicative of accessing or copying these sensitive files. The rule also includes a condition for Node.js processes attempting to exfiltrate credential-related data. The detection logic combines multiple conditions, such as browser credential access with SSH key theft, or cloud credential access with crypto wallet access, and Node.js exfiltration attempts combined with any of the credential/wallet access patterns.
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of distinct mailboxes belonging to other users. 2) Identifies users accessing a high number of distinct folders within another user's mailbox. Both parts are designed to flag potential unauthorized access, data exfiltration, or reconnaissance activities within an Exchange Online environment.
Page 134 of 173