Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,665 detections
Filters
Last updated
All Time
Detection languages
10,181
119
110
99
60
Contributors
2,815
2,800
1,768
504
492
Categories
4,275
2,971
2,237
1,829
1,457
Platforms
10,376
1,102
802
155
98
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects the use of curl.exe to download content from a remote source and pipe it directly into PowerShell for execution. This is a fileless execution technique used by adversaries like Storm-0249 to bypass traditional file-based defenses.
This rule detects attempts to discover Group Policy settings on a Windows system. It identifies the execution of common command-line interpreters (cmd.exe, powershell.exe, wmic.exe, rundll32.exe) followed by specific commands or PowerShell cmdlets used for GPO enumeration. This includes native Windows commands like 'gpresult' and 'secedit', registry queries for policy settings, and PowerShell cmdlets such as 'Get-GPO' and 'Get-GPResultantSetOfPolicy'. Additionally, it looks for LDAP-related commands or patterns ('ldapsearch', 'groupPolicyContainer') that might indicate GPO discovery via directory services. The rule also correlates these process events with network connections to SYSVOL shares or LDAP ports (389, 636) to further confirm GPO-related activity.
This rule detects a specific sequence of commands often used by ransomware, particularly the '01flip' variant, to self-delete after execution. The sequence involves 'ping.exe' for a delay, 'fsutil.exe' to zero out file data, and 'cmd.exe' to delete files. The rule correlates these events within a short timeframe, initiated by the same process on a given device.
Detects the execution of the AutoHotKey interpreter (AutoHotKey.exe) as a child process of common initial access applications like web browsers, Microsoft Office products, or command-line interpreters. This behavior is a key indicator of the latest DarkGate malware infection chain.
Detects the mass renaming or creation of files with the '.01flip' extension, which is characteristic of the 01flip ransomware. A high count of these files on a single host is a strong indicator of an active ransomware infection.
This rule detects the execution of known proxyware applications such as Infatica, Honeygain, and IPRoyal by looking for specific command-line arguments. Proxyware applications monetize unused internet bandwidth by routing traffic through the user's device, which can pose security and privacy risks.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
This rule detects PowerShell processes that are initiated by a LOLBAS binary and subsequently establish an outbound network connection to a public IP address. It leverages an external LOLBAS JSON data source to identify suspicious parent processes. This behavior could indicate an adversary using a Living Off The Land Binary or Script (LOLBAS) to execute PowerShell for malicious purposes, such as command and control or data exfiltration.
This rule detects suspicious network connections to known malicious URLs associated with a Docker Desktop malware campaign. It also identifies instances where 'DockerDesktop.exe' is executed or present in unusual file paths, suggesting potential masquerading or unauthorized deployment outside of its standard installation directory. The rule is broken into three parts: network events, file events, and process events. The network part looks for connections to specific malicious domains. The file and process parts look for 'DockerDesktop.exe' in folders other than the assumed legitimate installation path, indicating potential malicious activity.
This rule detects the creation or modification of executable files with a single-character filename followed by '.exe' (e.g., 'a.exe', 'b.exe'). This pattern is often used by adversaries to evade detection or to make malicious files less conspicuous. The rule specifically excludes 'R for Windows front-end' to reduce false positives related to legitimate software.
This rule detects applications, other than common web browsers, that are making network connections to Google Analytics domains and also contain 'microsoft' in the remote URL. This could indicate an application collecting device information or other telemetry and exfiltrating it via Google Analytics, potentially for malicious purposes or unauthorized data collection.
This rule detects instances where the calculator application (calc.exe) initiates a network connection. This behavior is highly unusual for a standard calculator application and could indicate malicious activity, such as an adversary using calc.exe as a proxy for network communication or injecting malicious code into it.
This query hunts for indicators of compromise (IOCs) and behaviors linked to the LockBit 5.0 ransomware variant. It identifies the creation of the ransom note, suspicious file renaming patterns using hexadecimal extensions, and network connections to known command-and-control (C2) infrastructure associated with LockBit activity.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
This detection looks for browser network traffic to URLs containing common social engineering keywords and common web page file extensions, while excluding trusted domains. This activity is associated with the Matrix Push C2 framework, which uses malicious browser notifications to lure users to phishing pages.
Detects the execution of 'conhost.exe' with the '--headless' argument, specifically when initiated by 'pcalua.exe'. This combination has been observed in attacks by the GOLD BLADE threat group for indirect command execution.
Detects the creation or modification of files with SHA256 hashes known to be associated with the Shai-Hulud 2.0 npm supply chain attack campaign. This rule specifically looks for file creation or renaming events where the SHA256 hash of the file matches a predefined list of malicious hashes.
Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.
This rule set detects several indicators of compromise related to the Shai-Hulud threat activity. It identifies specific malicious file hashes (SHA256) for 'bundle.js' files, the execution of the 'trufflehog' tool which is often abused for secrets discovery, the presence of a malicious YAML file named 'shai-hulud-workflow.yml', and network connections to 'webhook.site' domains, optionally with a specific URI, which are used for data exfiltration or command and control.
Page 460 of 508