Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
7
4
4
3
2
Contributors
5
3
3
2
2
Categories
11
6
3
3
3
Platforms
10
8
4
3
1
Products / Services
4
3
2
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
4
IDS Protocols
2
1
1
Detects modification of sensitive Active Directory LDAP attributes (msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, scriptPath, msTSInitialProgram, msDS-KeyCredentialLink) via Windows Security EventCode 5136, and correlates the initiating session back to its originating logon (EventCode 4624) to surface the actor's SID, domain, source IP, and logon host. These attributes are commonly abused for Kerberos delegation abuse (constrained/resource-based constrained delegation), logon-script/Terminal-Services persistence, and Shadow Credentials (msDS-KeyCredentialLink) attacks. Includes anchor fields (initiator SID, domain controller, distinct-attribute count, operation correlation ID) to support precise, low-blast-radius tuning instead of broad exclusions.
This rule detects the creation or modification of specific script files in common Linux persistence locations: '/etc/profile.d/' or '/usr/local/lib/'. Adversaries may modify or create scripts like '.sh.local' or '.cache-update.sh' in these directories to establish persistence, as these scripts can be executed automatically during system boot or user login.
This rule detects the creation of the 'class-wc-subscription-diagnostics.php' backdoor file followed by a network connection to the command and control (C2) domain 'generate.2faplugin.org' within a 30-minute window on the same device. This correlation indicates a potential supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to 2FA exfiltration.
Detects deployment of malicious network logon scripts via domain SYSVOL
This rule detects attempts to modify login scripts, specifically '.profile', on a remote host via SSH. The detection is based on observing the string ".profile" within TCP traffic destined for port 22 (SSH) on the home network. This activity could indicate an attacker establishing persistence by modifying user login scripts to execute malicious commands upon subsequent logins.
This rule detects the writing of a file containing both the string "Startup" (case-insensitive) and the string ".bat" (case-insensitive) to a remote host via the Server Message Block (SMB) protocol on port 445. This activity is indicative of an attempt to establish persistence by creating a startup script on a remote system.
This rule detects when a batch script (.bat) is dropped onto a network share, specifically targeting the NETLOGON share, which is often used for logon scripts. This activity can be indicative of an attacker attempting to establish persistence or execute malicious code on systems that process logon scripts from this share. The rule triggers if three such events are observed from the same source within 60 seconds.
This rule detects the HTTP download of common boot script file types (batch, command, shell, PowerShell) that contain the string 'HKLM' (HKEY_LOCAL_MACHINE). This combination suggests an attempt to establish persistence or execute malicious code by modifying system-wide registry settings, often associated with trojan activity. The detection is based on the file extension in the URI and the content within the downloaded file's data.
Detects suspicious execution or persistence artifacts in /etc/rc.d/ or /usr/local/libexec/ipsec/ on edge firewalls, specifically indicating VerdantBamboo's BRICKSTORM malware on pfSense appliances. The rule looks for process command lines or folder paths containing "/usr/local/libexec/ipsec/blacklist" or modifications to "/etc/rc.d/cron" that include "blacklist".
Detects the creation of the 'vector_notice.sh' script in the '/etc/profile.d/' directory. The VECT ransomware (Linux and ESXi variants) drops this shell script to display a ransom note to users upon shell login.
Detects the creation of 'vector_notice.sh' in '/etc/profile.d/', a shell script dropped by VECT ransomware on Linux systems to display its ransom note upon user login. This rule specifically looks for file creation events on Linux systems where the target file name matches the exact path '/etc/profile.d/vector_notice.sh'.
Detects the creation of a malicious Python script (`sysmon.py`) within the user's systemd directory. This specific file and path are utilized by the TeamPCP compromised Trivy binary to establish persistence on developer machines when the GITHUB_ACTIONS environment variable is not set to "true".
Detects malicious Message of the Day scripts for persistence
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
Detects creation of malicious init.d scripts for persistence
To accompany Hunting rule equivalent at
https://detections.ai/rules/019c91c0-b2e0-759d-a61c-78d08e1d3d99
To accompany Hunting rule equivalent at
https://detections.ai/rules/019c91c0-b2e0-759d-a61c-78d08e1d3d99
Looks for Metadata IOCs as listed in the CISA report on BrickStorm C2 malware.
I don't recommend using this query on its own; rather, use it in conjunction with behavioural analysis to look for evidence of BrickStorm activity.
https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF
I don't recommend using this query on its own; rather, use it in conjunction with behavioural analysis to look for evidence of BrickStorm activity.
https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF
Detects the creation of `spinstall0.aspx`, a known indicator of successful post-exploitation of the SharePoint vulnerability CVE-2025-53770.
Goal: Find machines in the last N days where the SystemGuardSecurityLevel value NOW is less than it was BEFORE.
Step 1: Get a list of all security levels in the system where the level is not null.
Step 1: Get a list of all security levels in the system where the level is not null.
'Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days.
Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.'
Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.'
This rule detects modifications to the user data script of an EC2 instance in AWS. User data scripts are executed when an EC2 instance is launched and can be used to perform initial setup, install software, or run other commands. An adversary modifying this script could achieve persistence or privilege escalation by injecting malicious commands that run upon the next instance boot.
Detects when an AWS region is enabled or disabled.
Page 1 of 2