Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
81
61
8
7
5
Contributors
29
26
22
20
14
Categories
51
33
31
25
23
Platforms
149
16
12
5
2
Products / Services
51
39
14
13
12
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
2
1
IDS Protocols
3
Detects the creation of a Cloud Files API sync root with the specific provider name 'SERIOUSLYMSFT' used by the RedSun LPE exploit to abuse Windows Defender's cloud file rollback mechanism. This rule looks for the specific string 'SERIOUSLYMSFT' in registry value updates (RegValueUpdate) or in command-line arguments of executed processes (ProcessRollup2).
Detects usage of WinAPI functions in PowerShell scripts.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
Detects a typical pattern of a CobaltStrike BOF which inject into other processes
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
detects BPFDoor .lock and .pid files access in temporary file storage facility
Detects the use of the PowerShell 'Add-Type' cmdlet to dynamically define a C# class containing Win32 API functions commonly used for process injection. This technique is leveraged by the Dead#Vax loader to inject its final payload, such as AsyncRAT, into the memory of legitimate processes without dropping a decrypted binary to disk.
Detects the execution or loading of the Tiny C Compiler (TCC) runtime (libtcc.dll, tcc.exe) by non-development processes. This 'living-on-edge' compilation technique, observed in use by actors like Lotus Blossom, helps bypass static file-based detections by compiling malicious code directly on the host.
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Detects PowerShell scripts using Windows API calls for parent process ID spoofing, enabling malicious processes to masquerade as legitimate system processes.
Detects the LANDFALL Android spyware manipulating SELinux policy by preloading a malicious shared object and passing a path to the 'l.so' policy manipulator component via the PRELOAD_PATH environment variable.
ICEEVENT: MSVC x64 thunk/prologue patterns + distinctive 'Servcie' error strings
This detection identifies processes that have executed on a host in the last 7 days but were not observed in the previous 30 days. This is useful for detecting potentially malicious or anomalous activity, such as new software installations, LOLBins, or attacker tools introduced during a compromise.
Detects possible prompt injection or abuse of AI models like LLMs via unusual process and API call patterns
This detection rule identifies processes that call the 'GlobalMemoryStatusEx' Windows API. This behavior is a known sandbox evasion technique used by malware, including SLOW#TEMPEST, to check the system's physical memory size before executing a malicious payload. The rule is tuned to focus on unsigned processes or those running from non-standard locations and with low host prevalence.
KQL Query from file: Azure Cloud Security Monitoring
KQL Query
KQL Query
KQL Query from file: Detecting FIDO2 Passkey Abuse
Page 6 of 9