Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects ClickFix-style browser or explorer spawned command execution using clipboard-paste patterns, or subsequent ransomware-related discovery and inhibit-system-recovery commands such as net.exe, nltest.exe, and vssadmin.exe used after initial access.
Detects a sequence of suspicious activities on a Windows host aimed at inhibiting system recovery, such as deleting shadow copies, modifying boot recovery configurations, deleting backup catalogs, or stopping security and backup-related services. This rule aggregates distinct categories of these actions by DeviceId and Account to identify potential malicious intent characteristic of ransomware or data destructive attacks.
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
Detects the presence of an XMRig cryptocurrency miner masquerading as the systemd-logind process. The rule identifies processes named 'systemd-logind' that either reside in an incorrect file path ('/usr/sbin/systemd-logind') or utilize command-line arguments characteristic of XMRig mining activity. This behavior is associated with the CARBONATO botnet.
Detects malicious activity involving the HTS software update mechanism, where the legitimate updater or patch processes are leveraged to download and execute the HTSPnew.exe ransomware payload.
Detects the execution of the KRSID ransomware binary, which is written in Rust. The rule identifies the malware based on its unique file extensions, ransom note filenames, specific command-line arguments, log file indicators, and compiled code characteristics.
This rule detects potentially suspicious activity within a Git repository environment, specifically monitoring for code pushes, administrative changes (such as added collaborators, permission changes, or ownership transfers), and force push operations. It identifies high-impact repository modifications that could indicate unauthorized access, persistence, or attempts to disrupt repository integrity.
Detects the deletion of Volume Shadow Copies using the Windows Management Instrumentation Command-line (WMIC) utility. This behavior is commonly observed in ransomware attacks, including those attributed to DragonForce and CRPx0, as a method to inhibit system recovery prior to file encryption.
Detects malicious tampering with GitHub Actions workflows by monitoring for two specific patterns within an hour: the addition of automatic push triggers for the main branch alongside the removal of manual approval gates, or rapid sequential commits that rewrite workflows to facilitate an unattended publish of a package. This rule also integrates with npm registry publish events to identify potential malicious distribution of compromised packages like @dforge-core/dforge-mcp.
Detects instances where a repository's GitHub CI/CD workflow, git configuration, or repository settings are modified, followed shortly thereafter by an npm package publish event. This behavior is indicative of a supply chain compromise where an adversary modifies workflow files to auto-publish malicious versions of a package.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
Detects instances where an AI agent (e.g., Semantic Kernel) launches command-line tools commonly used to perform bulk data destruction or system wiping, such as file deletion commands, volume shadow copy removal, or disk formatting. This rule flags suspicious orchestration by AI agents that may be acting outside of expected parameters.
Detects a potential destructive activity pattern involving the staging of a payload in a non-standard directory (utilizing a directory name with a trailing space) followed by a burst of file deletions on the same device. This behavior is indicative of a secondary destructive payload execution, often associated with disk-wiping malware.
Detects the creation of a mutex with the 'Global\evolution' prefix, which is a known indicator of the XMRig cryptocurrency miner execution.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects unauthorized modification of system cron files by the redis-server process, indicative of rogue redis replication exploitation, followed by the execution of a cron job associated with the XMRig cryptocurrency miner.
Detects the mass termination of security, backup, database, and virtualization services and processes. The rule monitors for the use of 'taskkill', 'sc', and 'net stop' commands, targeting a list of processes and services often associated with pre-encryption cleanup activities by ransomware actors to neutralize security tools and data access controls.
Detects modifications to payroll direct deposit or payment election settings within Workday. This activity is a common indicator of payroll fraud or Business Email Compromise (BEC), where an attacker gains access to an employee's Workday account to redirect salary payments to an unauthorized bank account.
Detects high-volume deletion or recycling of files within OneDrive or SharePoint for a specific user, which may indicate malicious activity such as data destruction, ransomware, or unauthorized data exfiltration staging.
Page 16 of 149