Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39,970 detections
Filters
Last updated
All Time
Detection languages
15,299
13,596
2,791
1,803
1,720
Contributors
7,678
5,999
5,313
4,504
4,191
Categories
18,073
9,745
3,841
3,747
3,711
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
10,402
9,646
6,669
1,890
1,856
MITRE Techniques
13,733
13,093
8,052
5,935
4,411
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
171
20
16
8
Detects potential Kerberoasting activity where a single account requests RC4-encrypted (0x17) Kerberos service tickets for multiple distinct service accounts within a one-hour window.
Detects the execution of two or more distinct Active Directory discovery, credential extraction, or coercion tools (such as NetExec, Kerbrute, noPac, PetitPotam, SoftPerfect Network Scanner, or Impacket scripts) on the same device within a 1-hour window.
Detects potential pass-the-hash (PtH) attacks via command-line execution of offensive tooling (such as Impacket, CrackMapExec, NetExec, Evil-WinRM) specifying NT hashes, as well as remote NTLM network logons from non-standard workstation names characteristic of Linux-based attacker tools spreading across multiple endpoints.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects browser processes accessing a chatgpt.com/share/ link followed shortly thereafter by connections to multiple distinct external hosts, potentially indicating exfiltration or unauthorized interaction following an AI chat reference.
Detects command-line execution of script interpreters (PowerShell, CMD, MSHTA) spawned via Windows Explorer containing download primitives and URLs, followed by immediate external network connections.
The KQL rule detects a ClickFix-style technique in which script hosts reference files disguised with an f_* naming pattern in browser profile cache directories. The key behavioural indicators are:
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
Detects Microsoft Word (winword.exe) spawning the Windows command shell (cmd.exe) to execute batch scripts (.bat or .cmd files). This behavior is commonly associated with malicious document macros attempting to drop and execute secondary payloads, excluding common system paths to reduce false positives.
Detects PowerShell processes combining local loopback listener terms (such as HttpListener or TcpListener) and authentication or web request cmdlets referencing 127.0.0.1 or localhost, correlated with local network loopback connections.
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects instances where an AOMEI-related process initiates an outbound WebDAV-style connection to a public host, followed closely by a Windows WebClient service (svchost.exe) connection to the same remote IP address.
The detection targets these behaviours:
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
- Attempts to take ownership of or replace explorer.exe and gpedit.msc.
- Changes to Microsoft Edge's Image File Execution Options (IFEO) debugger.
- Changes to HTTP, HTTPS, HTML, and Microsoft Edge protocol handlers.
- Disabling Explorer's Run command and changing keyboard scancode mappings.
- Creation of temporary VBScript files used for relaunching, elevation prompts, or deceptive messages
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects DeElevate64.exe within the Stardock Smart DeElevation Tool directory loading I++u.dll, a known malicious loader dependency associated with patched DeElevator64.dll usage.
Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.
Detects a sequence where a Codex agent process executes a shell or command interpreter, followed by logging or monitoring tampering activity on the same device within a 30-minute window.
Detects a suspicious sequence where a client IP performs a brute-force attack against WordPress login or XML-RPC endpoints followed by enumeration of the wp-json REST API.
Detects PaperCut server processes (such as pc-app.exe, pc-server.exe, or Java running PaperCut) spawning command shells or utility binaries associated with credential dumping, internal reconnaissance, or pivoting.
Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.
Detects the execution of known Remote Monitoring and Management (RMM) tools within a 30-minute window following Microsoft Teams network activity on the same device, which can be an indicator of unauthorized remote access or interactive command and control setup via remote support applications.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Page 5 of 1904