Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
39,970 detections
Filters
Last updated
All Time
Detection languages
15,299
13,596
2,791
1,803
1,720
Contributors
7,678
5,999
5,313
4,504
4,191
Categories
18,073
9,745
3,841
3,747
3,711
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
10,402
9,646
6,669
1,890
1,856
MITRE Techniques
13,733
13,093
8,052
5,935
4,411
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
171
20
16
8
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects instances where rundll32.exe is executed with no arguments or minimal arguments, matching the typical Cobalt Strike spawn-to sacrificial process behavior. Aggregated per device, account, and parent process.
Detects rundll32.exe creating a named pipe and subsequently establishing an SMB (port 445) connection to a private IP address within a 10-minute window, indicative of potential lateral movement or internal reconnaissance.
Detects host reconnaissance activities (such as whoami or systeminfo) executed via Remote Monitoring and Management (RMM) tools or accompanied by suspicious PowerShell download and execution activity within a specific time window.
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Detects a sequence where PowerShell disables security or monitoring preferences (defense evasion / sensor blinding) followed closely by injecting code or performing process hollowing into a Windows process from the same PowerShell process.
Detects instances where Setup.exe loads the winmm.dll module from the same non-system directory located in user-writable paths (such as Users, Downloads, AppData, Temp, or ProgramData), which is indicative of DLL hijacking or side-loading activity.
Detects the Yoba campaign behavior involving the staging of wmpdmc.exe along with wmpdui.dll or ampdui.dll in the ProgramData\WMProcess directory, followed by execution or invocation via scheduled tasks.
Correlates an IDE or extension host process querying api.ipify.org with a subsequent git command configuring the global user email on the same device within a 5-minute window. This behavior can be indicative of malicious setup or automated post-compromise activity.
Detects a Run/RunOnce registry value whose data points to an
executable or script in a user-writable location (AppData, Temp, ProgramData,
Users\\Public). Amatera establishes persistence by adding Run key entries that
relaunch the stealer on user logon.
executable or script in a user-writable location (AppData, Temp, ProgramData,
Users\\Public). Amatera establishes persistence by adding Run key entries that
relaunch the stealer on user logon.
Detects process command lines referencing browser credential
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
store filenames such as Chromium "Login Data"/Cookies and Firefox
logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy
or read these files to harvest saved passwords and session cookies for
account takeover.
Detects high volume and diverse URI requests targeting login, search, or inquiry endpoints on IIS servers within a short time window, indicative of web brute force or active reconnaissance scanning.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects administrative access to the DLP console from an unfamiliar address. Console
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
Detects Windows systems that have not installed a patch or update within the last 45 days by querying Quick Fix Engineering (QFE) installation dates.
Detects a sequence where a device runs a staging/archiving utility (such as WinRAR, 7-Zip, or a copy script) followed within 4 hours by a file transfer or synchronization tool (such as rclone or FileZilla), which is indicative of data staging prior to exfiltration.
Detects ABNotify.exe, running from the standard AOMEI Backupper installation path,
spawning any executable located in the html\ rendering hierarchy. This directory is
intended for rendering assets, not executables; a child process launched from here
indicates a hijacked upgrade workflow triggered through the AOMEI notification agent
with no user interaction.
spawning any executable located in the html\ rendering hierarchy. This directory is
intended for rendering assets, not executables; a child process launched from here
indicates a hijacked upgrade workflow triggered through the AOMEI notification agent
with no user interaction.
Detects cmd.exe launched from the Windows Run dialog (explorer.exe
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
parent) downloading a payload with a living-off-the-land transfer utility such as
certutil, bitsadmin or curl. ClickFix pasted commands frequently chain cmd.exe with
these built-in binaries to fetch the secondary malware stage.
Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.
Detects backup service processes writing server-side scripts into web-accessible directories, indicating potential web shell deployment after application compromise.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Page 9 of 1904