Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects suspected exploitation of CVE-2026-81963, an Elevation of Privilege vulnerability in the Windows Update stack. The rule monitors for the creation of reparse points, junctions, or symbolic links within update staging paths by Windows Update processes, followed by either the spawning of suspicious child processes or unauthorized file writes/renames outside of expected directories, which are indicative of a privileged link-following exploit.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
The following analytic detects shells, scripting engines, and common post-exploitation utilities spawned as child processes of smsexec.exe.
smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters.
An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe.
If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise.
smsexec.exe is the core SCCM SMS Executive service process and has no legitimate reason to launch interactive shells or scripting interpreters.
An attacker who plants a malicious adsource.dll in the SCCMProvider bin\X64 directory will obtain code execution in the SCCM service context, typically resulting in a SYSTEM-level child process being spawned under smsexec.exe.
If confirmed malicious, this activity represents successful exploitation of the SCCM SMS Executive service and should be treated as a full host compromise.
Detects instances where WerFault.exe or WerMgr.exe, running with SYSTEM privileges, loads a DLL file from the Windows\System32 directory that was created within 10 minutes of the image load event. This behavior is indicative of potential DLL side-loading or hijack techniques used to achieve privilege escalation.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
Detects the creation of specific Object Manager namespace directories and objects used by the ShieldCrash proof-of-concept (CVE-2026-69414) to hijack the Microsoft Defender scan process.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
This rule monitors the software inventory for outdated versions of the PostgreSQL database server. It identifies installations where the major and minor versions are below the threshold for current security releases (e.g., v18 < 6, v17 < 11, v16 < 15, v15 < 19, v14 < 24). Running outdated software increases the risk of exploitation of known vulnerabilities.
Detects potential exploitation attempts involving the NVIDIA global shared memory object (GreenSection) identified as \BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}. The rule monitors for processes performing memory section operations (e.g., NtMapViewOfSection) in conjunction with driver-related command-line indicators or associated malicious process names, which may indicate an attempt to trigger a crash in nvoglv64.dll or exploit driver-level vulnerabilities.
Detects instances where a database role initially possessing only REPLICATION privileges is elevated to a SUPERUSER role, which represents a significant escalation of privilege within a PostgreSQL environment.
Detects anomalous access to specific memory sections associated with Desktop Window Manager (dwm.exe) followed by a crash of the same process within a 30-minute window. This behavioral pattern is often indicative of exploitation attempts targeting DWM memory management to achieve code execution or privilege escalation.
Detects the 'LegacyHive.exe' process initiating child processes running under the SYSTEM account context. This behavior is indicative of potential privilege escalation or malicious persistence mechanisms where a process spawns a child with elevated permissions.
Detects the execution or initiation of a process named 'PrettyPrague.exe' while running with SYSTEM level privileges (AccountSid: S-1-5-18) from directories associated with Avast antivirus software. This activity is indicative of potential privilege escalation or malicious activity masquerading within legitimate security software paths.
Detects instances where a database role initially possessing only REPLICATION privileges is elevated to a SUPERUSER role, which represents a significant escalation of privilege within a PostgreSQL environment.
Detects instances where a database role initially possessing only REPLICATION privileges is elevated to a SUPERUSER role, which represents a significant escalation of privilege within a PostgreSQL environment.
Detects the loading or usage of the malicious driver 'DCRCVDrv.sys' associated with the ClearFake crypto stealer campaign, which uses a Bring-Your-Own-Vulnerable-Driver (BYOVD) technique to interact with the device path '\Device\DCRCVDRV_U' to terminate or impair EDR and security tools.
Page 14 of 45