Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39,252 detections
Filters
Last updated
All Time
Detection languages
14,996
13,546
2,513
1,803
1,722
Contributors
7,678
6,007
5,306
4,504
4,026
Categories
17,755
9,465
3,749
3,677
3,674
Platforms
39,252
6,892
6,432
3,782
3,524
Products / Services
10,159
9,415
6,493
1,858
1,706
MITRE Techniques
13,649
12,957
7,908
5,843
4,364
CVEs
50
45
30
30
29
IDS Classtypes
214
56
36
24
19
IDS Protocols
177
171
20
17
8
Detects a specific evasion behavior associated with the NinjaMare malware, where a process idles for at least 7 minutes before moving its window to off-screen coordinates during automated mouse or keystroke input, followed by restoring the window to its original position.
Detects instances where the Windows Remote Management host process (wsmprovhost.exe) is associated with the execution of specific suspicious files (config.toml, cplsupport.exe, or wtass.exe) within a short time window. This activity often indicates post-exploitation behavior or remote execution of secondary tools using WinRM.
Detects modifications to the 'metrics_interval' registry value within the 'Software\SynapseAgent' key. This activity suggests configuration changes to the SynapseAgent, which could indicate tampering with agent telemetry or polling frequency.
Detects Toy Ghouls backdoor binaries (cplsupport.exe and wtass.exe) via known MD5 hashes or the presence of these files alongside a config.toml configuration file.
Detects the presence of Toy Ghouls' mqtt-bird-agent or matrix-bird-agent backdoor binaries. These binaries are identified by specific filenames, the inclusion of ChaCha20-Poly1305 cryptographic indicators, and operations involving the Windows MachineGuid registry key used to seal configuration files.
Detects the execution of known potentially malicious tools cplsupport.exe and wtass.exe with install parameters, or the creation of a Windows service associated with these filenames using sc.exe. This activity is indicative of service-based persistence or malicious software installation.
This rule detects potential persistence attempts by monitoring for the execution and service installation commands of specific binaries: cplsupport.exe and wtass.exe. The rule triggers if these files are executed directly, invoked with specific command-line arguments (e.g., '--install'), or used in conjunction with the 'sc.exe' utility to create new services, which is a common technique for establishing persistence or privilege escalation.
Detects the modification or creation of the 'SealedConfig' value within the 'Software\synapse\Config' registry key, correlated with the deletion of a 'config.toml' file on the same device. This pattern may indicate an adversary tampering with Synapse software configuration or attempting to remove audit/configuration trails.
Detects the execution of Windowsupdate.exe, a known component of the QUICSILVER campaign. The backdoor is identified by its filename and specific file hash. Once executed, it facilitates system and directory discovery, including hostname enumeration and file system navigation.
Detects network activity initiated by the QUICAgent backdoor (Windowsupdate.exe), which is utilized for file exfiltration and payload delivery. The detection is triggered by identifying the specific file name 'Windowsupdate.exe' in conjunction with the known malicious SHA-256 hash associated with this backdoor.
Detects reconnaissance patterns associated with SynkLoader, specifically focusing on in-memory PowerShell execution used to harvest system information, user privileges, running services, process listings, and Active Directory computer counts.
Detects the presence of small PHP files containing both PHP execution tags and path traversal sequences. This pattern is indicative of a web shell or malicious script placed outside of intended directories via path traversal exploitation.
Detects files that present a valid PNG magic header at the start but contain embedded PostScript instructions. This pattern is commonly used to exploit vulnerabilities in image processing libraries like Ghostscript or ImageMagick, which may attempt to process the file as PostScript despite the misleading header.
This rule detects the execution of Windows Explorer (explorer.exe) with specific command-line arguments involving a factory initialization sequence and an embedding flag. This command line pattern is typically associated with shell object manipulation or specific COM object instantiation, which may be leveraged for process injection or hiding malicious activity.
Detects the use of rundll32.exe to invoke the MiniDump export function of comsvcs.dll to create a memory dump of the LSASS process. This technique is often associated with post-exploitation credential access tools like lsassy or manual execution via remote management tools (e.g., WMI, MMC) by threat actors such as those in the Bumblebee/Akira ransomware intrusion chain.
Detects ClickFix-style social engineering attacks where users are lured into executing obfuscated commands via terminal copy-paste. The detection monitors for the sequential execution of remote file downloads (e.g., curl, PowerShell) followed immediately by shell history-clearing commands designed to obfuscate the malicious activity. This behavior is associated with macOS crypto-drainers and loaders.
Detects the deletion of Volume Shadow Copies using native Windows utilities like WMIC or PowerShell cmdlets (Get-WmiObject, Get-CimInstance) targeting Win32_ShadowCopy. This behavior is a common indicator of ransomware preparation to inhibit system recovery prior to encryption, as observed in attacks involving the Akira ransomware.
Detects the execution of the Windows Installer utility (msiexec.exe) where the command line references an Azure Blob Storage URL. This pattern is commonly used by adversaries to download and install malicious MSI packages directly from a remote storage location, bypassing local file creation.
Tracks changes and activities affecting a specific user account across both on-premises Active Directory and Microsoft Entra ID. The query combines Windows Security Events and Entra ID Audit Logs into a single timeline, making it easier to investigate account modifications, privilege changes, MFA updates, directory synchronization activity, and administrative actions impacting a user.
This detection is particularly useful during incident response, insider threat investigations, account compromise assessments, and user lifecycle reviews
This detection is particularly useful during incident response, insider threat investigations, account compromise assessments, and user lifecycle reviews
Detects the modification or creation of an NTFS alternate data stream (ADS) on the system file phoneinfo.dll in System32, followed by the execution of a command process within two minutes. This pattern is often associated with file-based living-off-the-land techniques where attackers hide payloads or scripts within existing file metadata to evade detection.
Detects activity related to the registration or attachment of a 'ShieldBreak' cloud provider, identified through specific file paths and event actions. This behavior is indicative of potential unauthorized cloud filtering or provider registration, often used in malicious scenarios to intercept or redirect traffic.
Page 443 of 1870