Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
60,142 detections
Filters
Last updated
All Time
Detection languages
23,200
16,896
4,280
4,077
3,289
Contributors
11,679
8,664
7,082
6,786
4,478
Categories
20,099
11,460
5,732
4,980
4,798
Platforms
39,723
6,855
6,349
4,079
3,510
Products / Services
10,351
9,601
6,991
4,335
3,859
MITRE Techniques
18,034
15,417
12,647
8,188
6,021
CVEs
68
68
58
56
50
IDS Classtypes
1,896
482
449
381
237
IDS Protocols
2,379
848
406
318
97
Detects the presence or execution of known malicious Remote Monitoring and Management (RMM) tool binaries associated with phishing campaigns, such as those impersonating MSP360 or ScreenConnect.
Detects the presence or execution of known malicious Remote Monitoring and Management (RMM) tool binaries associated with phishing campaigns, such as those impersonating MSP360 or ScreenConnect.
This rule monitors for DNS queries and network connections to a known list of malicious domains associated with phishing campaigns that deploy remote access tools (such as ScreenConnect or MSP360). These campaigns typically involve users interacting with malicious links to trigger downloads or remote management sessions.
Detects the execution of MSP360 or generic RMM-labeled binaries originating from common user download directories (Downloads or Temp folders) when the filename mimics common phishing lures such as invoice, e-card, RSVP, or document-related naming conventions. This activity indicates a potential social engineering attempt to execute remote monitoring and management tools.
Detects instances where a legitimate Remote Monitoring and Management (RMM) agent (MSP360 or Faronics) is used to execute PowerShell commands that silently install ScreenConnect (ConnectWise Control) MSI packages within a 10-minute window. This behavior is indicative of an adversary abusing administrative tools for lateral movement or persistence.
This rule detects the execution of potentially malicious binaries masquerading as legitimate Windows utilities (e.g., Windows Update, Defender, or Phone Link) from within a ScreenConnect temporary directory. This behavior is indicative of a phishing attack where an adversary uses remote access tools to stage and execute malicious payloads on a victim's system.
Detects potential persistence and network persistence mechanisms associated with the MSP360 RMM agent. The rule correlates the creation of a Windows service for RMM.Agent.exe or RMM.Agent.Launcher.exe with the addition of a firewall rule allowing UDP traffic on port 48678 by netsh or PowerShell, occurring within a one-hour window.
Detects the presence or execution of known malicious Remote Monitoring and Management (RMM) tool binaries associated with phishing campaigns, such as those impersonating MSP360 or ScreenConnect.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
Detects command-line activity indicative of attempts to perform a DCSync attack, a method used to simulate the replication process of a Domain Controller to extract sensitive Active Directory credentials, including password hashes, using tools like Mimikatz or DSInternals.
