Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,427
11,813
5,871
5,145
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects the creation of DLL files in the `C:\Windows\System32` or `C:\Windows\SysWOW64` directories by processes that are not themselves located in these system directories. This behavior can indicate DLL planting, a technique used for persistence, privilege escalation, or defense evasion, often associated with DLL search order hijacking or side-loading. The rule excludes known legitimate activities such as printer driver installations and specific noisy legitimate software processes.
This rule detects the execution of common accessibility tools (osk.exe, powershell.exe, pwsh.exe, cmd.exe, reg.exe) with command-line arguments indicating an attempt to modify or leverage Windows accessibility features for persistence or privilege escalation. Specifically, it looks for command lines referencing 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility' and 'ATConfig\osk' or 'Accessibility\Session'. This behavior is often associated with adversaries attempting to maintain access or elevate privileges by manipulating accessibility programs like the On-Screen Keyboard.
Detects potential exploitation of the RegPwn privilege escalation vulnerability (CVE-2026-24291).
The exploit involves creating a registry symbolic link in a user-writable accessibility configuration path that is later accessed by a SYSTEM process.
This allows an attacker to write to an arbitrary registry location as SYSTEM. This rule detects the creation of the malicious registry symlink, the payload execution where osk.exe modifies a service, and the command-line arguments of the public proof-of-concept tool.
The exploit involves creating a registry symbolic link in a user-writable accessibility configuration path that is later accessed by a SYSTEM process.
This allows an attacker to write to an arbitrary registry location as SYSTEM. This rule detects the creation of the malicious registry symlink, the payload execution where osk.exe modifies a service, and the command-line arguments of the public proof-of-concept tool.
Storm-2561 Network IOC Detection
Cortex XDR
Detects outbound network connections from Windows endpoints to known Storm-2561 Command and Control (C2) infrastructure, including a specific C2 IP address and various domains used for credential exfiltration and initial access via spoofed VPN services.
Detects web requests for specific JavaScript file names that are part of the DarkSword iOS exploit chain. The presence of these requests strongly suggests a device is being targeted with the exploit kit.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
This rule detects specific JavaScript obfuscation patterns used by the Coruna exploit kit framework. The kit was observed being used by multiple threat actors, including UNC6353 and UNC6691. The rule looks for two distinct patterns in process command lines: a map/join/fromCharCode obfuscation pattern and an integer XOR obfuscation pattern, typically executed by JavaScript-enabled processes like web browsers or scripting hosts.
Detects multiple crashes from key iOS system processes within a short time window. This pattern is indicative of a failed memory corruption attempt, consistent with the sandbox escape and privilege escalation techniques used by the DarkSword exploit kit.
KQL Query
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
Detects BigQuery queries using CONCAT with CHR functions to dynamically build cross-project paths, bypassing dot filters. High-fidelity indicator of LeakyLooker-style SQL injection.
Detects attempts to bypass authentication in SolarWinds Web Help Desk by exploiting the page restoration mechanism (CVE-2025-40552, CVE-2025-40554). An attacker can specify a sensitive page via the 'wopage' parameter to gain access to post-authentication functionality without valid credentials.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
Detects attempts to exploit a remote code execution vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use hex-encoded escape sequences (`\xNN`) and other JSON parsing gotchas to bypass security filters and achieve deserialization of malicious objects.
Detects attempts to exploit a deserialization vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use non-standard hex escape sequences (e.g., `\xNN`) in JSON payloads to bypass security filters and achieve remote code execution.
Detects a vulnerable GitHub Actions workflow configuration known as a "Pwn Request". This occurs when a workflow is triggered by `pull_request_target` but checks out and executes untrusted code from the head of the pull request (`${{ github.event.pull_request.head.sha }}`). This allows an attacker to run arbitrary code with the permissions of the target repository, including access to secrets. This pattern was actively exploited by the 'hackerbot-claw' campaign. This rule should be applied to files in the `.github/workflows/` directory.
Azure Impossible Travel Detection
Cortex XDR
Detects an identity signing in from two or more distinct geolocations within a one-hour window in Azure, indicating potential impossible travel activity.
Detects URL click events or browser launches where the URL targets Microsoft or Google OAuth endpoints and contains the combination of 'prompt=none' and 'scope=invalid'. This specific combination is used by attackers to force a silent error redirect to a malicious URI.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Detects the JavaScript XOR-based string reconstruction pattern used by the Coruna iOS exploit kit. This pattern maps an array of integers through String.fromCharCode with XOR to reconstruct code at runtime. Coruna contained 23 iOS exploits targeting iOS 13.0 through 17.2.1 and was used by UNC6353 (Russian espionage) and UNC6691 (Chinese financially motivated).
Detects the loading of specific drivers known to be vulnerable and abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level privileges and disable security tools.
Page 116 of 159