Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects the installation or loading of the POORTRY (Abyssworker) driver, a vulnerable driver used by Osiris ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software. This rule identifies the driver by its file name, service name, known hashes, and a masquerading technique where it pretends to be a Malwarebytes component.
Detects the creation of a local user account with root privileges (UID 0) using the 'useradd' command with the non-unique flag. This technique is used by threats like EncystPHP to create stealthy administrative accounts (e.g., 'newfpbx') for persistent access.
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack discovered by Yuval Gordon (@YuG0rd) from Akamai. It allows a low-privileged user with 'CreateChild' permissions over any Organizational Unit (OU) in an Active Directory domain to escalate privileges to Domain Administrator. This detection rule identifies execution patterns or behavioral indicators linked to SharpSuccessor activity, which may signal privilege escalation attempts in Active Directory environments.
Detects when the Landlock Linux Security Module (LSM) denies an access request from a sandboxed application. This indicates that a process is attempting to perform an action that violates its predefined security policy, which can be a sign of misconfiguration or malicious activity such as exploitation.
This KQL query identifies potential Bring Your Own Vulnerable Driver (BYOVD) activity associated with the Shanya packer by detecting the creation/modification of known vulnerable or malicious driver files (e.g., ThrottleStop.sys, rwdrv.sys, hlpdrv.sys) and their subsequent loads, a technique used to gain kernel access for disabling EDR/AV tools in ransomware attacks.
Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.
Detects the attachment of a virtual disk (.vmdk) likely belonging to a Domain Controller to another virtual machine. This technique is used by threat actors like SCATTERED SPIDER to access the Active Directory database (ntds.dit) for offline credential dumping. This is often done on a newly created, attacker-controlled VM.
Detects command line parameter very often used with coin miners
Detects a sequence of file operations indicative of CLFS Base Log File (.blf) tampering, a technique used in CVE-2024-49138 exploitation. The detection looks for a process writing to a .blf file, immediately followed by a read of the same file, which is an unusual pattern as regular applications use CLFS APIs, not direct file writes.
Detects suspicious print spool service (spoolsv.exe) child processes.
Detects process crashes within the Samsung 'libimagecodec.quram.so' library, which could indicate an exploitation attempt related to the LANDFALL spyware (CVE-2025-21042, CVE-2025-21043).
This rule detects the loading of known vulnerable drivers by their file names. Adversaries often leverage these vulnerable drivers to achieve privilege escalation or persistence on a system, typically by exploiting a known vulnerability in the driver to execute arbitrary code in kernel mode. The list of driver file names included in the detection logic corresponds to drivers identified as vulnerable, often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks.
Detects the loading of known malicious drivers by their MD5, SHA1, SHA256, or IMPHASH. These drivers are often used by adversaries for persistence and privilege escalation, particularly in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to gain kernel-level access.
This rule detects the loading of known malicious drivers by their file names. Adversaries often use malicious drivers for persistence, privilege escalation, or to evade defenses. The rule specifically looks for a predefined list of driver filenames that have been identified as malicious or associated with vulnerable drivers exploited by attackers. This detection is based on the 'ImageLoaded' field, which indicates when a driver is loaded into the system.
This rule detects the creation of a child process with SYSTEM privileges where the parent process was running under a LOCAL SERVICE or NETWORK SERVICE account. This behavior is often indicative of privilege escalation techniques such as Rotten Potato or RogueWinRM, which exploit vulnerabilities to elevate privileges from service accounts to SYSTEM.
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root by specifying a user ID of -1 or 4294967295 (NO_UID_T) with the '-u' option, bypassing the sudoers policy.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root without authentication by specifying a user ID of -1 or 4294967295.
This rule detects a suspicious `explorer.exe` subprocess spawned by `RazerInstaller.exe` with elevated privileges (System integrity level). While `explorer.exe` can be legitimately invoked by the installer to select a different installation folder, this specific behavior with System integrity can indicate an attempt to exploit a vulnerability in the RazerInstaller software for privilege escalation to LOCAL SYSTEM.
Detects suspicious child processes created by CrushFTP, which could indicate the exploitation of a Remote Code Execution (RCE) vulnerability like CVE-2025-54309. The rule specifically looks for PowerShell, cmd, bitsadmin, certutil, mshta, cscript, or wscript processes spawned by CrushFTP, often with command-line arguments indicative of malicious activity (e.g., IEX, encoded commands for PowerShell, or common system commands for cmd).
Page 36 of 45