Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
(CVE-2026-26117)
(CVE-2026-26117)
This rule detects the instantiation of the TieringEngine COM object, identified by the GUID '50d185b9-fff3-4656-92c7-e4018da4361d', via process creation events. This activity is associated with CVE-2026-33825, a zero-day vulnerability that could be exploited by malware like RedSun. The rule specifically looks for this GUID in the command line of newly created processes.
Detects potential “HashJack” prompt injection attempts in AI tool activity. This technique, known as HashJack, attempts to manipulate AI models by hiding instructions after the '#' in a URL. The rule specifically looks for URLs within submitted prompts that contain fragments with suspicious keywords indicative of prompt injection, such as "ignore previous", "override instructions", "system prompt", etc.
This rule detects the creation or connection to a named pipe with the specific name 'REDSUN'. This activity is associated with the RedSun PoC (Proof of Concept) for CVE-2026-33825, a zero-day vulnerability in Windows Defender. The rule looks for events indicating named pipe creation or connection across various security event sources, including Falcon native events and Sysmon events (Event IDs 17 and 18).
Detects the creation of symbolic links targeting the Restricted kernel object namespace, which the BlueHammer exploit uses for path confusion during a TOCTOU race condition to achieve Local Privilege Escalation.
Detects Adobe Reader initiating unexpected network connections, which may indicate an exploit fetching a secondary payload or communicating with a C2 server.
Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations
Detects the usage of Cloud Files API (CfRegisterSyncRoot or CfConnectSyncRoot) by untrusted applications. This technique is notably used by the BlueHammer LPE zero-day to set a timing trap and freeze Windows Defender.
Detects suspicious behavior associated with an Adobe Reader zero-day exploit, including specific network connections, suspicious user-agent strings, registry persistence, and specific image loads (e.g., ntdll.dll or bootsvc.dll).
This rule detects outbound network connections from Adobe Reader (AcroRd32.exe) or Adobe Acrobat (Acrobat.exe) processes on Windows platforms to known malicious C2 IP addresses. This activity is indicative of potential compromise, likely stemming from an exploit targeting Adobe products, as observed in a sophisticated zero-day campaign.
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This rule detects the loading of drivers that are known to be vulnerable, as listed in the LOLDrivers.io database. It correlates driver load events with a curated list of vulnerable driver hashes (SHA1 and SHA256) to identify potential Bring Your Own Vulnerable Driver (BYOVD) attacks.
This query identifies HTTP(S) requests logged within Ivanti EPMM (formerly MobileIron) logs that match exploitation URI parameters, specifically looking for '/mifs/c/appstore/fob' and '=gPath' in the HTTP_Request_URI. The EPMM Version number is also extracted to provide additional context for security teams to identify if their software version is vulnerable.
This rule detects suspicious activity involving multiple POST requests to Livewire update endpoints on web servers, followed by the spawning of unusual processes from web server parent processes (php, apache, httpd, nginx, php-fpm). The spawned processes of interest include various shells (sh, bash), command-line tools (curl, wget, python, perl, nc), or commands containing base64 encoding, chmod +x, or /tmp/ paths. This behavior could indicate a web shell compromise or successful exploitation leading to command execution.
Detects the creation of specific executable files (rwdrv.sys, hlpdrv.sys, msimg32.dll) associated with the Qilin EDR killer malware. This rule specifically looks for these files being written to disk, excluding legitimate writes of msimg32.dll to standard Windows system directories to reduce false positives.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
Detects the creation of specific webshell files (GW.class, payload.bin, or dpr_<8-hex-digits>.jsp) associated with CVE-2026-4681 weaponization on PTC Windchill and FlexPLM servers, or suspicious web requests containing patterns which could indicate exploitation attempts.
This rule detects exploitation attempts against Oracle WebLogic servers by identifying HTTP requests that target known WebLogic administrative or internal endpoints and simultaneously contain indicators of command execution payloads within the URL. Specifically, it looks for URLs containing '/console/', '/wls-wsat/', '/bea_wls_internal/', or '/_async/' combined with keywords like 'cmd=', 'bash', 'powershell', 'wget', 'curl', 'base64', 'IEX', or 'Runtime.getRuntime'. The rule also requires the source IP to be different from the target IP, indicating an external attacker. This pattern is typical of Remote Code Execution (RCE) exploitation attempts, including those targeting vulnerabilities like CVE-2026-21962.
Detects cases where a source previously blocked by AWS WAF later receives a successful ALLOW, indicating a possible bypass attempt or rule tuning requirement after high-volume scanning.
Detects the initial CTRL execution chain where a malicious LNK launches hidden PowerShell, writes ms-settings UAC bypass registry keys including DelegateExecute, then starts fodhelper.exe. This rule correlates process events for PowerShell executing with a hidden window style and obfuscated commands, registry modifications to the ms-settings UAC bypass key, and the subsequent execution of fodhelper.exe.
Page 114 of 159