Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
(CVE-2026-26117)
(CVE-2026-26117)
KQL Query from file: Detection for ShadowHound
Detects suspicious processes attempting to access Microsoft Teams local storage or cookies via command line parameters, a technique commonly used by info-stealers. The rule specifically looks for command line arguments targeting 'Cookies' or 'Local Storage\leveldb' paths within the Microsoft Teams directory, while excluding legitimate Teams executables to reduce false positives.
Detects non-Defender processes accessing the Windows Defender signature definition file (mpasbase.vdm). This file should exclusively be accessed by Defender platform processes (MsMpEng.exe, MpCmdRun.exe, NisSrv.exe, etc.) and Windows servicing components. Any other process touching this file has zero legitimate use cases and is a high-fidelity indicator of the BlueHammer zero-day LPE exploit, which leverages a batch oplock on mpasbase.vdm to freeze Defender mid-read, then performs NTFS junction swapping to redirect SYSTEM-context reads to the SAM hive via a VSS snapshot, resulting in local credential theft and privilege escalation. MITRE: T1068 - Exploitation for Privilege Escalation. References: https://github.com/Nightmare-Eclipse/BlueHammer, https://www.deobfuscated.dev/posts/defender-lpe-0-day
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Detects calls to hidden files or files located in hidden directories in NIX systems.
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Potential threat actor tampering with Sysmon manifest and eventually disabling it
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
This rule detects the access or creation of Microsoft Office files (docx, xlsx, pptx) that have 'password' or related keywords in their filename or folder path. It also attempts to identify if these files contain password-related content through DLP indicators, suggesting potential sensitive data exposure or staging.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
detects BPFDoor .lock and .pid files access in temporary file storage facility
Detects non-browser processes accessing sensitive files within web browser profiles, such as credential stores (Login Data), cookies, or local storage databases (LevelDB). This behavior is indicative of credential theft and was observed in multiple modules of the StegaBin infostealer toolkit, which targeted browser-stored credentials and cryptocurrency wallet extensions.
This rule detects various indicators associated with a developer-targeting campaign, including Node.js fetching remote JavaScript from untrusted PaaS domains, dynamic loader behavior in next.config.js, repeated beaconing to C2 paths, detached child Node interpreters, directory enumeration and exfiltration behavior, and suspicious access to sensitive files on developer machines.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
Detects processes attempting to read or copy the Apple Keychain database file (login.keychain-db). Unauthorized access to this file is a strong indicator of credential theft activity, as seen with stealers like AMOS.
Page 69 of 76