Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
25
20
3
2
2
Contributors
15
10
5
4
3
Categories
16
13
10
8
6
Platforms
44
4
3
2
2
Products / Services
15
11
9
7
6
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
CVEs
2
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects attempts to exploit a SharePoint vulnerability that involves bypassing SafeControls via quote-injection within the Register directive. The rule monitors POST requests to .aspx files for specific malicious patterns, including the use of 'ignoreParentFrozen' and malformed 'Register' tags that facilitate unauthorized code execution.
This rule detects the creation or pushing of a local Git branch where the branch name matches the pattern of a 40-character SHA-1 or 64-character SHA-256 hash. This behavior is indicative of the Plugin4Shell exploitation technique, where attackers create branches named after specific commit SHAs to bypass security checks on self-hosted Git services like Bitbucket by pinning them to unintended commits.
Detects screensharingd or its child helper processes accessing TCC-protected data categories on hosts with no prior TCC grant recorded for screensharingd, indicating a TCC bypass via the Screen Sharing exploit chain.
Detects rapid Socket.IO 'key' event traffic directed at the unauthenticated Remote Mouse service (TCP 1313) followed by the spawning of command shell processes (cmd.exe, powershell.exe) on the same host. This pattern aligns with the Metasploit Remote Mouse RCE module, where an attacker simulates keystrokes to execute arbitrary commands.
Detects instances where 'MpClient.dll', a legitimate Microsoft Defender component, is loaded by a process that is not a known, trusted Microsoft Defender executable. This behavior can indicate an attempt to abuse Defender's scanning or cleaning APIs for malicious purposes, as seen in 'RoguePlanet' style attacks.
Detects execution patterns associated with the DirtyClone (CVE-2026-43503) exploit, which involves an unprivileged process utilizing user and network namespaces to configure IPsec XFRM Security Associations (SAs) to corrupt the kernel page cache of sensitive binaries such as /usr/bin/su.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
This rule detects suspicious executable or DLL file creations in common temporary or user-writable directories shortly after a Microsoft Defender related process (MsMpEng, Nissrv, Werfault, Services) terminates unexpectedly. The rule focuses on the causality chain to link the Defender crash with the subsequent file placement, suggesting an attempt to bypass or disable security software before deploying malicious payloads.
Detects exploitation of application vulnerabilities for denial of service
Detects the loading of the Huawei HWAuidoOs2Ec.sys driver, which has been abused in Bring Your Own Vulnerable Driver (BYOVD) attacks for defense evasion and privilege escalation.
Detects whenever a QoS with throttleRate is created by a Windows Service. This behaviour is normally associated with EDR Supression.
Detects exploitation of application vulnerabilities for denial of service
This rule detects HTTP requests containing multiple common HTTP header names (X-Forwarded-For, X-Real-IP, X-Originating-IP) in the 'http.header_names' field. This pattern is often associated with attempts to bypass Web Application Firewalls (WAFs) or other security devices by injecting junk or spoofed headers to confuse or misdirect them.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Detects non-Defender processes accessing the Windows Defender signature definition file (mpasbase.vdm). This file should exclusively be accessed by Defender platform processes (MsMpEng.exe, MpCmdRun.exe, NisSrv.exe, etc.) and Windows servicing components. Any other process touching this file has zero legitimate use cases and is a high-fidelity indicator of the BlueHammer zero-day LPE exploit, which leverages a batch oplock on mpasbase.vdm to freeze Defender mid-read, then performs NTFS junction swapping to redirect SYSTEM-context reads to the SAM hive via a VSS snapshot, resulting in local credential theft and privilege escalation. MITRE: T1068 - Exploitation for Privilege Escalation. References: https://github.com/Nightmare-Eclipse/BlueHammer, https://www.deobfuscated.dev/posts/defender-lpe-0-day
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Audit CVE Event
Sigma
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
Page 1 of 3