Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39,970 detections
Filters
Last updated
All Time
Detection languages
15,299
13,596
2,791
1,803
1,720
Contributors
7,678
5,999
5,313
4,504
4,191
Categories
18,073
9,745
3,841
3,747
3,711
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
10,402
9,646
6,669
1,890
1,856
MITRE Techniques
13,733
13,093
8,052
5,935
4,411
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
171
20
16
8
Detects googleupdate.exe loading an unsigned DLL from a non-standard path, followed by network communication to a known Command and Control (C2) domain or IP address.
Detects the execution of Remote Monitoring and Management (RMM) tools followed closely (within 1 day) by potential data exfiltration activity using tools like WinSCP or Rclone, or connections to cloud storage providers (OneDrive, Google Drive) from the same device.
Detects a sequence where a device exhibits Remote Monitoring and Management (RMM) tool execution followed by high-volume outbound network connections to consumer cloud storage services (such as OneDrive or Google Drive) from the same device, potentially indicating data exfiltration via RMM.
Detects instances where a web browser accesses a domain listed in the 'AdFection_Domains' watchlist, followed closely by the browser spawning a script interpreter (such as PowerShell, wscript, cscript, mshta) or dropping an executable/script file in user profile or temporary directories.
Detects a burst of file modifications producing common
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
Detects rundll32.exe executing inline JavaScript/VBScript via the
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects abnormal PHP execution volume storms, process crashes handled by crash reporters (such as werfault.exe, apport, systemd-coredump), or application error events related to PHP, which may indicate denial of service attacks, exploitation attempts, or severe application instability.
Detects attempts to inhibit system recovery by stopping the Volume Shadow Copy Service (VSS) using utilities like net, net1, or sc, or deleting shadow copies using vssadmin.exe, excluding known backup agents.
Detects the correlation of remote execution tools (such as PsExec, WinRM, or specific PowerShell remote execution commands) with RDP or ScreenConnect remote management activity on the same device within a one-hour window, potentially indicating lateral movement or unauthorized remote control.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
The following analytic detects the use of the taskkill command in a process command line to terminate several known browser processes, a technique commonly employed by the Braodo stealer malware to steal credentials. By forcefully closing browsers like Chrome, Edge, and Firefox, the malware can unlock files that store sensitive information, such as passwords and login data. This detection focuses on identifying taskkill commands targeting these browsers, signaling malicious intent. Early detection allows security teams to investigate and prevent further credential theft and system compromise.
Detects web server processes writing PHP files into sensitive WordPress directories (such as mu-plugins or rank-math-pro/includes) shortly after deleting them within a 1-hour window. This behavior often indicates the rebuilding or updating of a webshell or backdoor for persistence.
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.
Detects browser processes accessing a chatgpt.com/share/ link followed shortly thereafter by connections to multiple distinct external hosts, potentially indicating exfiltration or unauthorized interaction following an AI chat reference.
Detects web server processes (such as apache2, nginx, httpd, php-fpm, or w3wp.exe) spawning shell interpreters (such as bash, sh, cmd.exe, or powershell.exe), which is a common indicator of web shell activity or application exploitation.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects potential cryptocurrency clipper malware by monitoring the staging of multiple attacker wallet addresses (BTC, ETH, TRC) under the HKCU\Software\Clipper registry path by a non-system process.
Detects the creation of a scheduled task named ChromeUpdate with highest privileges on logon, initiated from a process running within the user AppData\Local\Temp directory.
Page 11 of 1904