Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects the creation of a process where the parent process is 'node.exe' (associated with Node.js, often used by VS Code extensions) and the child process is either 'ScreenConnect.ClientService.exe' or has 'ScreenConnect' in its command line. This behavior could indicate a VS Code extension spawning a ScreenConnect remote access tool, which might be malicious.
Detects PowerShell execution initiated by the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs'. This technique is used as a LOLBIN to proxy malicious PowerShell commands, as seen in campaigns delivering Amatera Stealer.
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
This rule detects network connections to a predefined list of malicious domains, many of which are hosted on Vercel and appear to be associated with phishing campaigns. The domains often mimic legitimate services or financial documents, suggesting an attempt to deliver malware or steal credentials through phishing. The rule specifically looks for these domains in the 'RemoteUrl' field of 'DeviceNetworkEvents'.
Detects the installation or loading of the POORTRY (Abyssworker) driver, a vulnerable driver used by Osiris ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software. This rule identifies the driver by its file name, service name, known hashes, and a masquerading technique where it pretends to be a Malwarebytes component.
This rule detects suspicious command-line activity involving 'conhost.exe' running in headless mode, combined with specific keywords often associated with malware or malicious scripts. The presence of '--headless' with other suspicious strings like 'svchost.exe', 'certutil -decode', common temporary directories, or specific file extensions/initiating processes (cmd.exe, powershell.exe, curl) suggests an attempt to execute hidden or obfuscated malicious code. This pattern is frequently observed in various stages of an attack, including execution, persistence, and defense evasion.
Esta detección identifica posibles conexiones relacionadas con el uso de VPNs dentro del entorno corporativo, correlacionando puertos asociados a protocolos VPN, dominios no habituales, procesos iniciadores y adaptadores de red virtuales o tunelizados. El objetivo es descubrir actividad de VPN no autorizada, conexiones cifradas ocultas dentro de tráfico HTTPS y el uso de extensiones de navegador que actúan como túneles tipo VPN.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
This query identifies devices with specific versions of installed software that are considered vulnerable. It is a template that can be easily adapted to track any software by changing the placeholder variables. It enriches the findings with device and user information for easier investigation.
This rule identifies the use of specific malicious code signing certificates by matching their SHA1 thumbprints against a predefined list. These certificates are known to be associated with various threat actors or malicious software, indicating potential supply chain compromise or the use of signed malware.
This rule detects unsigned executables originating from the WindowsApps directory that are making network connections to IP lookup services. This behavior can indicate a potentially malicious application attempting to identify its external IP address, possibly for command and control communication or reconnaissance. Common browsers are excluded from this detection to reduce false positives.
This rule detects the presence and activity of known malicious browser extensions, specifically 'NexShield' and those associated with the 'KongTuke' campaign. It identifies these extensions by their unique IDs found in file paths or names, network connections to associated malicious IPs or domains, and specific file hashes. The rule correlates file events, network events, and process events to provide a comprehensive view of the malicious extension's activity, including when it was first and last seen, the browsers involved, and the files/folders it interacted with.
A widespread campaign employs malvertising to distribute converter tools that secretly install persistent Remote Access Trojans. These droppers establish scheduled tasks and leverage code signing to load and execute further malicious .NET assemblies from command-and-control servers, enabling continuous system access and data exfiltration.
This rule detects the presence or execution of known malicious infostealer files based on their SHA256 hash values or a specific filename pattern. The SHA256 hashes are associated with infostealer malware as referenced in a VirusTotal blog post. The filename pattern 'malwarebytes-windows-github-io' also indicates potential malicious activity, likely related to a deceptive download or execution.
This rule detects network connections to known cryptocurrency mining pools or domains associated with cryptocurrency mining activities. It specifically looks for keywords like 'miningpool', 'stratum', 'xmr', 'ethash', 'moneropool' in the remote URL or specific IP addresses like 'connect.moneropool.com' and 'pool.supportxmr.com'. This activity often indicates unauthorized resource hijacking (cryptojacking) on the affected device.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with the '/Create' argument. This can indicate an adversary establishing persistence or scheduling malicious activity.
This rule detects suspicious process creation patterns indicative of the MuddyWater (also known as RustyWater) APT group. Specifically, it looks for Microsoft Office applications (Word, Excel, PowerPoint) launching scripting or Living Off The Land Binaries (LOLBins) such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, wscript.exe, or cscript.exe. The detection is further narrowed down by checking if these processes are created in suspicious writable paths like ProgramData, Users\Public, AppData\Roaming, or AppData\Local\Temp. Additionally, the rule includes optional enrichment for known MuddyWater/RustyWater payload names (reddit.exe, art.exe, cloud.exe, nginx.exe), persistence via the Run registry key, and the dropping of a specific staging artifact named 'CertificationKit.ini'.
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
Detects execution of TruffleHog, an open-source tool used to search repositories, files, and environments for secrets and credentials. Adversaries may use it to discover exposed credentials or sensitive information within source code or configuration files
Detects suspicious process access to common credential storage locations such as certificate stores, PCPKSP keys, and CloudAPCache for AzureAD credentials. The severity of the alert is escalated based on the initiating process and command line arguments, specifically looking for keywords like 'mimikatz', 'dump', or 'export'.
Detects the execution of a JScript file by cscript.exe using a legacy NTFS 8.3 shortname format. This is a specific behavior observed in Gootloader's persistence mechanism, where a .LNK file in the Startup folder executes a second-stage script.
This rule detects outbound network connections initiated by 'chrome.exe' to a predefined list of known Command and Control (C2) domains over HTTPS (port 443). This indicates potential communication with malicious infrastructure.
Page 458 of 509