Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation or registration of virtual machines using VMware ESXi CLI tools, PowerCLI, or Hyper-V PowerShell cmdlets. This behavior is often associated with adversary attempts to create backdoored VMs, isolate environments, or facilitate lateral movement and persistence within virtualized infrastructure.
Detects common tools and techniques used for Active Directory reconnaissance, including domain trust discovery, user and group enumeration, and computer discovery. The rule monitors for the execution of utilities like net.exe, nltest, AdFind, SharpHound, and PowerShell cmdlets associated with Active Directory modules, as well as the opening of files containing reconnaissance output.
Detects reconnaissance activity where an adversary uses common administrative utilities (e.g., wmic, powershell, tasklist, sc, reg) to identify installed security software, antivirus products, or monitoring agents on a Windows system. This activity is often a precursor to defense evasion or impairment.
Detects attempts to modify the WDigest UseLogonCredential registry value, which can be used to force Windows to store plaintext credentials in LSASS memory. Adversaries use this technique to facilitate credential dumping.
Detects the execution of command-line interfaces (cmd.exe, powershell.exe, wscript.exe, mshta.exe) when spawned by common browser processes or Windows Explorer. This is a common pattern for drive-by downloads or malicious scripts executed via the browser, characterized by command lines containing download indicators (e.g., Invoke-Expression, curl, certutil, encoded commands).
Detects the use of WinRAR (rar.exe or WinRAR.exe) to archive files, specifically flagging operations that involve recursion, password protection (-hp), or targeting network shares. This behavior is commonly used by adversaries for data staging prior to exfiltration.
This rule monitors email gateway and EDR telemetry for indicators associated with the CastleLoader malware and the EvilTokens phishing campaign. It flags specific keywords in email subjects, filenames, sender domains, and URLs, as well as suspicious binary execution patterns and child processes spawning from common office applications or web browsers.
Detects the use of the appcmd.exe utility to disable IIS HTTP logging by setting the 'dontLog' configuration attribute to 'True'. This behavior is commonly used by attackers to hide malicious activity, such as webshell POST requests, from being captured in IIS logs.
Detects Mimikatz-based credential dumping against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies this activity by monitoring for renamed or known Mimikatz binary names, execution of specific credential-harvesting command-line arguments (such as sekurlsa::logonpasswords or privilege::debug), output redirection to credential-related files, or the loading of the Mimikatz kernel driver (mimidrv.sys).
Detects reconnaissance activities where an adversary attempts to identify installed security software (AV, EDR, logging tools) on a Windows host. The rule identifies the execution of common discovery commands including PowerShell Get-MpComputerStatus, wmic, sc query, tasklist, and reg query targeting specific security process names and registry paths.
Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.
Detects potential persistence attempts via WMI event subscriptions. The rule monitors for the creation of WMI event consumers using 'wmic.exe' with suspicious command line arguments, or the use of 'mofcomp.exe' to compile MOF files by non-standard, non-Microsoft signed processes.
Detects execution of the Microsoft .NET installer utility (InstallUtil.exe) from non-standard locations. Adversaries often abuse InstallUtil.exe as a proxy to execute malicious code or bypass application control policies, as it is a trusted, digitally signed Microsoft binary. The rule filters out legitimate execution paths typically associated with .NET framework installations, SDKs, or system directories.
This rule detects the execution of common enumeration commands (net, dsquery) on systems identified as Domain Controllers. These commands are frequently used by adversaries for reconnaissance to identify local or domain users and groups after gaining access to a host.
Detects execution patterns associated with CVE-2026-46331 (pedit COW exploit), which uses a user namespace unshare operation, followed by tc pedit action abuse to perform page cache poisoning on /bin/su to achieve root privilege escalation. The rule monitors for the exploit binary, unshare namespace creation, tc command interaction, unauthorized root shell spawning by su/sudo, and attempts to clear page caches.
Detects execution and compilation activities associated with the DirtyPipe (CVE-2022-0847) vulnerability, which allows an unprivileged user to overwrite data in read-only files, leading to privilege escalation to root. The rule tracks common exploit filenames, compilation patterns, and specific commands used for privilege escalation via unshare or su.
Detects malicious PowerShell activity associated with the Gamaredon group, specifically targeting obfuscated command lines used for HTML smuggling and downloader execution. This rule monitors for combined Base64 and HTML entity decoding, .NET reflection-based assembly loading, suspicious mshta.exe spawning PowerShell, and PowerShell creating HTML files.
Detects the creation of potentially malicious executable or script files (.exe, .lnk, .vbs, .ps1, .hta) or autorun.inf files on removable drives (D-Z) initiated by common script interpreters or suspicious processes. This activity is then correlated with prior detections of Gamaredon (ACTINIUM/Primitive Bear) implant activity, such as Ptero-family malware, specific obfuscated PowerShell patterns, or HTML smuggling delivery via mail/Office clients on the same host within a 24-hour window.
Detects a suspected 5-step exploit sequence targeting CVE-2026-43503 on Linux systems. The rule monitors for unprivileged user and network namespace creation, followed by XFRM state modification, kernel module loading, raw ESP socket creation, and finally writing to /proc/[pid]/mem to facilitate page-cache corruption and bypass Copy-on-Write (CoW) protections.
Detects the use of legitimate Windows system utilities (ntdsutil.exe, vssadmin.exe, esentutl.exe) to interact with the Active Directory database file (ntds.dit). This behavior is commonly associated with offline credential harvesting, where an attacker attempts to create a copy of the database to extract hashes offline.
This rule detects the execution of known remote access tools (such as AnyDesk, TeamViewer, or RustDesk) that are spawned as child processes from common web browsers. It correlates process creation events with subsequent network connections by these tools to public IP addresses over specific ports commonly used by remote access software, within a 30-minute timeframe of the process start.
Page 395 of 976