Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same
Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120
Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.
Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects the creation of named pipes with patterns characteristic of the EfsPotato privilege escalation tool. This tool exploits a vulnerability related to the Encrypting File System (EFS) service to achieve local privilege escalation by creating specific named pipes for inter-process communication.
This rule detects the execution of the 'cloudflared' binary when it has been renamed. It looks for specific command-line arguments associated with Cloudflare Tunnel operations ('tunnel cleanup', 'tunnel run', '-url tunnel') in conjunction with a list of known SHA256 hashes for legitimate cloudflared executables. The rule triggers if these conditions are met and the executable's name is NOT one of the known legitimate 'cloudflared.exe' names, indicating a potential attempt to disguise its execution.
This rule detects the creation of files with uncommon extensions within Microsoft Office application startup folders, specifically for Word and Excel. Adversaries often leverage these folders to establish persistence by placing malicious documents, templates, or add-ins that execute automatically when the respective Office application is launched. The rule filters out common and legitimate Office file extensions to reduce false positives.
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. This technique can be used for defense evasion by masquerading the execution of arbitrary commands.
This rule detects network connections initiated by executables (excluding common internet browsers and known applications) to a list of legitimate, popular websites that have been previously identified as 'dead drop resolvers' in cyberattacks. Attackers leverage these trusted websites (e.g., Facebook, YouTube, Google Drive) to host C2 infrastructure or relay data, aiming to blend in with normal network traffic and evade detection. The rule specifically filters out connections from a comprehensive list of legitimate browser executables and other applications to reduce false positives.
Detects potential calls to NtOpenProcess directly from NTDLL.
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
Detects the creation of a file with an uncommon extension in an Office application startup folder
Detects the execution of the "cloudflared" binary from a non standard location.
Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB.
The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com.
The tool has been observed in use by threat groups including Akira ransomware.
The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com.
The tool has been observed in use by threat groups including Akira ransomware.
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
Detects the execution of a renamed "cloudflared" binary.
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Page 435 of 465