Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
8
3
1
Contributors
6
2
2
1
1
Categories
5
4
4
3
3
Platforms
7
5
5
1
Products / Services
4
3
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects EWM injection using SetWindowLongPtr API for code execution
This rule detects potential EWM (Event-Window-Message) injection attempts via the SetWindowLong API by looking for the presence of both "SetWindowLongPtr" and "GetWindowLongPtr" strings in HTTP client-bound file data. This technique is often used for privilege escalation or code injection.
Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
KQL Query
KQL Query
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query from file: Entra Admin Roles Query
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query from file: Threat Hunting Nation State Actors
Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
Looks for multiple users that had their admin role removed by a single user within a certain period.
This rule detects attempts to gain 'PROCESS_ALL_ACCESS' rights to specific, commonly used Windows processes such as 'calc.exe', 'notepad.exe', and 'mspaint.exe'. Granting 'PROCESS_ALL_ACCESS' provides the requesting process with all possible access rights to the target process, which can be abused by malicious software for process injection, privilege escalation, or defense evasion.