Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects potential abuse of Tailscale SSH Unix socket forwarding where the tailscaled daemon touches sensitive files/sockets (such as docker.sock or /etc/shadow) or creates/replaces Unix sockets following an SSH session.
Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain.
Detects the loading of the 'truesight.sys' driver from non-standard or temporary locations. This activity is associated with a campaign where threat actors use a vulnerable version of this driver to terminate security products before deploying ransomware or RATs, a technique known as Bring Your Own Vulnerable Driver (BYOVD).
Detects the launch of bad-bpf style eBPF rootkit loaders (pidhide with --pid-to-hide, sudoadd with --username) executed via sudo or from an interactive shell parent, representing the userspace step that issues bpf(BPF_PROG_LOAD) before tracepoint hooks go live.
Detects the AnyDesk Linux service running as root spawning a shell process (sh, bash, dash, zsh) or executing a command associated with the AnyPwn (CVE-2025-27918) post-exploitation behavior.
The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity.
The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.
The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.
The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Windows System service install EventCode 7045 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration. This detection is a Windows Event Log adaptation of the Sysmon driver loaded detection written by Michael Haag.
Detects the loading of an unsigned or untrusted kernel driver followed by the termination of known security (AV/EDR) processes within a 10-minute window. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation often used by ransomware actors to bypass endpoint security controls.
Detects the loading of the known vulnerable GIGABYTE driver (gdrv.sys) on Windows systems. Attackers leverage this driver as part of Bring Your Own Vulnerable Driver (BYOVD) attacks to perform privilege escalation by exploiting kernel-mode vulnerabilities.
Detects a sequence of events indicative of Bring Your Own Vulnerable Driver (BYOVD) exploitation. The rule correlates the creation of a new service with kernel-mode drivers, the loading of a signed driver, and the subsequent termination or disabling of common EDR security processes within a short timeframe, suggesting the exploitation of the driver to bypass EDR defenses.
Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.
Detects the loading of known vulnerable kernel drivers commonly used for Bring Your Own Vulnerable Driver (BYOVD) attacks, followed within 15 minutes by administrative attempts to stop, delete, or kill common security product processes or services.
Detects the loading of suspicious kernel drivers (Sysmon Event ID 6) that are unsigned, have invalid/revoked signatures, or are located in user-writable directories (e.g., Temp folders). This rule aims to identify Bring Your Own Vulnerable Driver (BYOVD) attacks, where adversaries load vulnerable drivers to escalate privileges or bypass security controls.
Detects 'unshare' creating a user/mount/net namespace by a non-root user, outside
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.
Detects the loading of a legitimately signed but vulnerable driver from suspicious directories (e.g., Temp, Downloads) followed closely by the termination of critical security/EDR service processes. This sequence is indicative of Bring Your Own Vulnerable Driver (BYOVD) exploitation used to disable security controls prior to ransomware deployment.
Page 1 of 45