Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,678 detections
Filters
Last updated
All Time
Detection languages
10,194
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,285
2,977
2,238
1,834
1,458
Platforms
10,389
1,109
809
155
98
Products / Services
10,678
9,759
6,693
4,421
3,749
MITRE Techniques
3,818
3,133
1,800
1,572
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
Detects a command-line pattern where nslookup is used to query a DNS server, and its output is piped to other commands to parse and execute a payload. This is a technique used by ClickFix campaigns to deliver malware via DNS.
Detects the creation of files in specific staging directories used by the CRESCENTHARVEST malware for collecting keylogs, browser data, and Telegram sessions before exfiltration. The rule specifically looks for 'daT.txt' in 'spool\Drivers\color', and any file creation within '\Windows\Temp\sysdriver\' or '\Windows\Temp\tdata\'.
This rule detects attempts to download the 'clawd.bot' or 'openclaw.ai' installation scripts using various command-line tools. It specifically looks for the use of 'curl', 'wget', 'aria2c', 'fetch', 'powershell', 'pwsh', 'certutil', 'bitsadmin', or 'mshta' when their command lines contain either 'clawd.bot/install.sh' or 'openclaw.ai/install.sh'. This activity is indicative of potential malware deployment or initial access attempts related to the OpenClaw/Clawd threat.
Detects behavioral indicators associated with a malware campaign distributing a credential and crypto-wallet stealer disguised as a Windows 11 update. Detection is based on TTPs rather than IOCs for longevity: suspicious directory creation, obfuscated PowerShell execution, and registry-based persistence.
Detects potential reverse shell activity originating from a Grandstream VoIP device. This is a high-fidelity indicator of compromise following the successful exploitation of CVE-2026-2329. This version uses DeviceNetworkEvents.
Detects the execution or loading of the Tiny C Compiler (TCC) runtime (libtcc.dll, tcc.exe) by non-development processes. This 'living-on-edge' compilation technique, observed in use by actors like Lotus Blossom, helps bypass static file-based detections by compiling malicious code directly on the host.
This rule detects suspicious enumeration of Azure Blob, File, Table, Queue, or DFS storage accounts by internal users. It identifies devices making network connections to public Azure storage URLs using potentially suspicious processes (e.g., PowerShell, Python, AzCopy, curl, wget, WinSCP, FileZilla, Storage Explorer). The rule then analyzes the distinct storage accounts accessed and uses a Jaccard index to identify unusual naming conventions among the accessed storage accounts, potentially indicating an insider attempting to discover or exfiltrate data from unfamiliar storage resources.
Detects network connections or DNS queries to domains and IP addresses identified as payload delivery and C2 infrastructure for a JWrapper/SimpleHelp RAT campaign. Monitoring these indicators can help detect initial compromise or ongoing C2 communication.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
Detects a specific obfuscated PowerShell command-line pattern used by the LunarApplication malware to execute scripts from the %TEMP% directory while bypassing execution policies. This rule looks for PowerShell processes with specific flags to bypass execution policy and accept piped input, combined with distinctive randomized script extensions (.yiz.ps1 or .unx.ps1) typically used by this malware.
This query detects multiple patterns of post-exploitation activity related to SolarWinds WebHelpDesk (WHD) vulnerabilities. It first identifies devices where suspicious commands are executed from the WHD directory, and then retrieves all related suspicious activities from those devices. The detection logic includes identifying suspicious child processes spawned by the WHD java service, suspicious command execution from the WHD directory, and suspicious child processes of ToolsIQ.exe, a component known to be abused in WHD exploits.
Detects the Microsoft Edge WebView2 process (msedgewebview2.exe) being spawned by suspicious parent processes that typically do not use embedded web content, such as PowerShell, CMD, or common lolbins. This activity is a key indicator of the 'AI-Proxy' technique where malware uses WebView2 to programmatically interact with AI web interfaces for C2.
Detects a BeyondTrust (Bomgar) process spawning shell or system administration child processes. This activity is highly indicative of OS command injection, potentially related to the exploitation of CVE-2026-1731.
This rule detects network connections to domains identified as malicious redirectors or landing pages used in a spam campaign that exploited Atlassian Jira. The domains are associated with phishing or malware distribution efforts.
This rule detects network communication with known command and control (C2) infrastructure associated with the OysterLoader malware. It identifies C2 activity by looking for connections to specific domains and IP addresses, as well as requests to particular API paths within the RemoteUrl field.
Detects the execution of icacls.exe to grant 'Full Control' permissions to the 'Everyone' group for the 'C:\ProgramData\SimpleHelp' directory. This tactic is used by the SimpleHelp RAT to ensure it can operate without permission restrictions and facilitate persistence.
Detects the creation of specific .sys files in the C:\Windows\System32\drivers\ directory. These filenames are used by the BADIIS malware installer to stage malicious DLLs before they are moved to other locations for execution.
Detects file activity associated with the LunarApplication malware, either by the known installer hash or by creation of files/directories within its installation path. This rule combines a high-fidelity hash with a specific folder path.
Detects the creation of JSON files within the '%LOCALAPPDATA%\Arkanix_lol\' directory. This folder is used by the Arkanix Stealer to stage stolen data before exfiltration, making this activity a strong indicator of infection.
Page 452 of 509