detection.wiki

Detection rule frameworks

Secondary groupings alongside the primary Enterprise ATT&CK browse: MITRE ATT&CK Mobile and ICS, MITRE ATLAS, the Sublime email-threat taxonomy, and other detection categories.

MITRE ATT&CK Mobile

Initial Access

Drive-By Compromise T1456 1 rule
Supply Chain Compromise T1474 2 rules
Phishing T1660 1 rule

Execution

Command and Scripting Interpreter T1623 1 rule

Persistence

Foreground Persistence T1541 1 rule
Event Triggered Execution T1624 1 rule
Hijack Execution Flow T1625 1 rule

Privilege Escalation

Exploitation for Privilege Escalation T1404 1 rule
Abuse Elevation Control Mechanism T1626 2 rules
Process Injection T1631 1 rule

Defense Evasion

Obfuscated Files or Information T1406 1 rule
Input Injection T1516 1 rule
Foreground Persistence T1541 1 rule
Hooking T1617 1 rule
Execution Guardrails T1627 1 rule
Hide Artifacts T1628 1 rule
Impair Defenses T1629 7 rules
Indicator Removal on Host T1630 2 rules
Process Injection T1631 1 rule
Virtualization/Sandbox Evasion T1633 1 rule
Masquerading T1655 1 rule

Credential Access

Clipboard Data T1414 1 rule
Input Capture T1417 2 rules
Access Notifications T1517 1 rule
Credentials from Password Store T1634 1 rule
Steal Application Access Token T1635 2 rules

Discovery

Software Discovery T1418 3 rules
System Network Configuration Discovery T1422 1 rule
Network Service Scanning T1423 1 rule
Process Discovery T1424 2 rules
Location Tracking T1430 1 rule

Lateral Movement

Exploitation of Remote Services T1428 1 rule

Collection

Stored Application Data T1409 1 rule
Clipboard Data T1414 1 rule
Input Capture T1417 2 rules
Audio Capture T1429 1 rule
Location Tracking T1430 1 rule
Video Capture T1512 1 rule
Screen Capture T1513 1 rule
Access Notifications T1517 1 rule
Archive Collected Data T1532 1 rule
Call Control T1616 1 rule
Protected User Data T1636 1 rule
Protected User Data: Contact List T1636.003 1 rule
Adversary-in-the-Middle T1638 1 rule

Command and Control

Web Service T1481 1 rule
Non-Standard Port T1509 1 rule
Ingress Tool Transfer T1544 1 rule
Call Control T1616 1 rule

Exfiltration

Exfiltration Over Alternative Protocol T1639 1 rule

Impact

Data Encrypted for Impact T1471 1 rule
Input Injection T1516 1 rule
SMS Control T1582 1 rule
Call Control T1616 1 rule
Account Access Removal T1640 1 rule
Data Manipulation T1641 2 rules
Endpoint Denial of Service T1642 1 rule
Generate Traffic from Victim T1643 1 rule

MITRE ATT&CK ICS

Initial Access

Exploit Public-Facing Application T0819 3 rules
External Remote Services T0822 1 rule
Rogue Master T0848 1 rule
Supply Chain Compromise T0862 1 rule
Spearphishing Attachment T0865 5 rules
Exploitation of Remote Services T0866 5 rules
Internet Accessible Device T0883 1 rule
Remote Services T0886 4 rules

Execution

Native API T0834 1 rule
Scripting T0853 7 rules
Change Operating Mode T0858 4 rules
User Execution T0863 4 rules
Execution through API T0871 5 rules

Persistence

Module Firmware T0839 1 rule
System Firmware T0857 2 rules
Valid Accounts T0859 7 rules
Project File Infection T0873 3 rules
Modify Program T0889 1 rule

Privilege Escalation

Exploitation for Privilege Escalation T0890 4 rules

Evasion

Rootkit T0851 1 rule
Change Operating Mode T0858 4 rules

Discovery

Network Connection Enumeration T0840 1 rule
Network Sniffing T0842 4 rules
Remote System Discovery T0846 1 rule
Remote System Information Discovery T0888 1 rule

Lateral Movement

Program Download T0843 2 rules
Valid Accounts T0859 7 rules
Exploitation of Remote Services T0866 5 rules
Remote Services T0886 4 rules

Collection

Program Upload T0845 1 rule

Command and Control

Connection Proxy T0884 1 rule
Commonly Used Port T0885 1 rule

Inhibit Response Function

Denial of Service T0814 1 rule
Device Restart/Shutdown T0816 1 rule
Rootkit T0851 1 rule
System Firmware T0857 2 rules
Service Stop T0881 1 rule

Impair Process Control

Brute Force I/O T0806 1 rule
Modify Parameter T0836 1 rule
Module Firmware T0839 1 rule
Unauthorized Command Message T0855 3 rules

Impact

Denial of Control T0813 3 rules
Loss of Availability T0826 4 rules
Loss of Control T0827 2 rules
Loss of Productivity and Revenue T0828 2 rules
Manipulation of Control T0831 1 rule
Loss of Protection T0837 1 rule
Damage to Property T0879 1 rule
Theft of Operational Information T0882 2 rules

Initial Access MITRE ATLAS

AI Supply Chain Compromise: Model AML.T0010.003 1 rule
Evade AI Model AML.T0015 2 rules

AI Model Access MITRE ATLAS

AI Model Inference API Access AML.T0040 1 rule
Full AI Model Access AML.T0044 2 rules

Execution MITRE ATLAS

LLM Prompt Injection AML.T0051 8 rules
AI Agent Tool Invocation AML.T0053 2 rules

Privilege Escalation MITRE ATLAS

AI Agent Tool Invocation AML.T0053 2 rules
LLM Jailbreak AML.T0054 7 rules

Defense Evasion MITRE ATLAS

Evade AI Model AML.T0015 2 rules
LLM Jailbreak AML.T0054 7 rules

Credential Access MITRE ATLAS

Unsecured Credentials AML.T0055 1 rule

Collection MITRE ATLAS

Data from AI Services AML.T0085 1 rule
Data from AI Services: AI Agent Tools AML.T0085.001 1 rule

Exfiltration MITRE ATLAS

Exfiltration via AI Inference API AML.T0024 1 rule
Exfiltration via AI Inference API: Infer Training Data Membership AML.T0024.000 1 rule
Exfiltration via AI Agent Tool Invocation AML.T0086 3 rules

Impact MITRE ATLAS

Evade AI Model AML.T0015 2 rules
Denial of AI Service AML.T0029 1 rule
Cost Harvesting AML.T0034 2 rules
Spamming AI System with Chaff Data AML.T0046 1 rule

Credential Phishing Sublime email taxonomy

Credential Phishing 1 rule
Encryption 14 rules
Evasion 350 rules
Exploit 5 rules
Free email provider 27 rules
Free file host 93 rules
Free subdomain host 47 rules
HTML injection 1 rule
HTML smuggling 44 rules
ICS Phishing 12 rules
IPFS 4 rules
ISO 1 rule
Image as content 30 rules
Impersonation: Brand 255 rules
Impersonation: Domain 2 rules
Impersonation: Email address 1 rule
Impersonation: Employee 13 rules
Impersonation: VIP 5 rules
LNK 1 rule
Lookalike domain 55 rules
Macros 7 rules
OneNote 4 rules
Open redirect 151 rules
Out of band pivot 8 rules
PDF 71 rules
Punycode 2 rules
QR code 30 rules
Scripting 41 rules
Service abuse 1 rule
Social engineering 500 rules
Spoofing 26 rules
No specific technique 8 rules

Malware/Ransomware Sublime email taxonomy

Encryption 18 rules
Evasion 160 rules
Exploit 10 rules
Free email provider 3 rules
Free file host 22 rules
Free subdomain host 10 rules
HTML smuggling 37 rules
ICS Phishing 7 rules
IPFS 2 rules
ISO 1 rule
Image as content 6 rules
Impersonation: Brand 19 rules
Impersonation: Domain 2 rules
Impersonation: Email address 1 rule
Impersonation: Employee 2 rules
LNK 6 rules
Lookalike domain 2 rules
Macros 13 rules
OneNote 1 rule
Open redirect 104 rules
Out of band pivot 2 rules
PDF 29 rules
Punycode 1 rule
QR code 3 rules
Scripting 53 rules
Social engineering 57 rules
Spoofing 3 rules
No specific technique 9 rules

BEC/Fraud Sublime email taxonomy

Encryption 2 rules
Evasion 79 rules
Free email provider 34 rules
Free file host 17 rules
Free subdomain host 6 rules
HTML injection 1 rule
ICS Phishing 4 rules
Image as content 3 rules
Impersonation: Brand 56 rules
Impersonation: Domain 2 rules
Impersonation: Email address 1 rule
Impersonation: Employee 15 rules
Impersonation: VIP 22 rules
Lookalike domain 12 rules
Macros 1 rule
OneNote 1 rule
Open redirect 6 rules
Out of band pivot 11 rules
PDF 23 rules
QR code 1 rule
Scripting 2 rules
Social engineering 202 rules
Spoofing 22 rules
No specific technique 2 rules

Callback Phishing Sublime email taxonomy

Encryption 1 rule
Evasion 34 rules
Exploit 3 rules
Free email provider 21 rules
Free file host 8 rules
Free subdomain host 3 rules
ICS Phishing 3 rules
Image as content 1 rule
Impersonation: Brand 43 rules
Impersonation: Employee 2 rules
Impersonation: VIP 1 rule
Lookalike domain 1 rule
Out of band pivot 33 rules
PDF 5 rules
Social engineering 85 rules
Spoofing 2 rules

Spam Sublime email taxonomy

Encryption 1 rule
Evasion 35 rules
Exploit 1 rule
Free email provider 23 rules
Free file host 10 rules
Free subdomain host 5 rules
ICS Phishing 2 rules
Image as content 7 rules
Impersonation: Brand 25 rules
Lookalike domain 4 rules
Open redirect 6 rules
Out of band pivot 2 rules
PDF 1 rule
Scripting 1 rule
Social engineering 66 rules
Spoofing 4 rules
No specific technique 4 rules

Extortion Sublime email taxonomy

Encryption 1 rule
Evasion 4 rules
Free file host 2 rules
Impersonation: Brand 5 rules
PDF 1 rule
Social engineering 8 rules
Spoofing 2 rules

Reconnaissance Sublime email taxonomy

No specific technique 2 rules

DLP: Credential Exposure Sublime email taxonomy

No specific technique 7 rules

DLP: Data Exfiltration Sublime email taxonomy

No specific technique 1 rule

DLP: Financial Sublime email taxonomy

No specific technique 4 rules

DLP: Financial Data Sublime email taxonomy

No specific technique 1 rule

DLP: GDPR Sublime email taxonomy

No specific technique 6 rules

DLP: HIPAA Sublime email taxonomy

No specific technique 3 rules

DLP: Infrastructure Sublime email taxonomy

No specific technique 2 rules

DLP: PCI Sublime email taxonomy

No specific technique 4 rules

DLP: PII Sublime email taxonomy

No specific technique 13 rules

ICS Phishing Sublime email taxonomy

Social engineering 1 rule

Uncategorized Sublime email taxonomy

Evasion 1 rule
Free subdomain host 1 rule
HTML smuggling 2 rules
ICS Phishing 1 rule
Impersonation: VIP 1 rule
Social engineering 1 rule
Spoofing 2 rules

Cloud & SaaS activity monitoring 410 rules

Cloud, SaaS, and identity governance: app registrations, OAuth grants, role and permission changes, sharing and config drift -- audit activity no single ATT&CK technique describes.

Veeam 96 rules
GCP 30 rules
AWS 27 rules
Kubernetes 24 rules
Google Workspace 17 rules
Auth0 16 rules
Notion 16 rules
Duo 15 rules
Entra ID / Azure AD 15 rules
GitHub 15 rules
Okta 14 rules
Snowflake 13 rules
Asana 11 rules
Snyk 10 rules
Dropbox 9 rules
Tines 9 rules
Microsoft Graph 7 rules
Push Security 7 rules
Zoom 7 rules
MongoDB 6 rules
Docusign 5 rules
Microsoft 365 5 rules
Axonius 4 rules
VMware SD-WAN and SASE 4 rules
CrowdStrike 3 rules
OneLogin 3 rules
Tailscale 3 rules
Other cloud & SaaS 19 rules

Endpoint & network anomalies 33 rules

Statistical and behavioral outliers on hosts and networks: process-tree analysis, command-line and volume spikes, baselining.

Panther 17 rules
Splunk 6 rules
Kusto 4 rules
YARA-L 4 rules
Elastic 2 rules

Threat-intelligence matching 53 rules

Indicator and reputation matching: hash, IP, URL, and domain lookups against threat feeds, VirusTotal, Safebrowsing, and prevalence sources.

YARA-L 28 rules
Panther 15 rules
Elastic 7 rules
Splunk 2 rules
Sublime MQL 1 rule

Alert correlation & meta-detections 85 rules

Meta-detections that consume the output of other detections or tools: multi-alert aggregation and vendor-verdict passthroughs.

Elastic 33 rules
Panther 28 rules
Kusto 17 rules
Splunk 4 rules
Sigma 2 rules
YARA-L 1 rule

Threat hunting 25 rules

Exploratory hunting queries that surface broad activity for analyst triage rather than firing on a specific malicious match.

YARA-L 17 rules
Kusto 7 rules
Panther 1 rule

AI & LLM governance 41 rules

AI and LLM content-safety and governance: prompt-injection, toxicity, bias, banned-topic, and model-policy violations.

Kusto 38 rules
Elastic 2 rules
Splunk 1 rule

Data loss prevention 130 rules

Data-loss-prevention content patterns: payment cards, national IDs, passports, bank accounts, and other regulated or sensitive data.

National IDs & passports 33 rules
Payment cards (PCI) 17 rules
Bank & financial accounts 15 rules
Health & medical 3 rules
Other sensitive data 62 rules

Operational & security hygiene 75 rules

Operational and security-hygiene checks: agent and signature staleness, unsupported versions, deployment posture, and outbreak thresholds.

Panther 46 rules
Kusto 22 rules
Sigma 3 rules
Splunk 3 rules
Elastic 1 rule