Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
310 detections
Filters
Last updated
All Time
Detection languages
109
82
51
42
8
Contributors
47
39
37
36
35
Categories
72
69
54
52
41
Platforms
173
26
26
22
15
Products / Services
30
30
25
25
21
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
Detects when events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection by removing forensic evidence.
Identifies when an Azure Firewall Rule Configuration is modified or deleted. This activity can indicate an adversary attempting to bypass network defenses or disrupt services.
Detects when a firewall rule is modified, deleted, or inserted in Google Cloud Platform (GCP). This activity can indicate an adversary attempting to impair defenses or establish persistence by altering network access controls.
Detects the creation of the file "/tmp/rootlog" which is used by the TripleCross eBPF rootkit as a way to check if the backdoor is already running. This file acts as a lockfile to prevent multiple instances of the rootkit from running simultaneously.
This rule identifies when a virtual network device in Azure, such as a network interface, network virtual appliance, virtual hub, or virtual router, is either modified or deleted. Monitoring these operations can help detect unauthorized changes or disruptions to network infrastructure.
Detects the usage of utilities such as 'systemctl', 'service', and 'chkconfig' to stop or disable services on a Linux system. This activity can be indicative of an adversary attempting to impair defenses or disrupt system operations.
This rule detects the termination of important Windows services, such as antivirus, firewall, Microsoft Defender components, BitLocker, and Encrypting File System (EFS). It specifically looks for Event ID 7023 from the 'Service Control Manager' provider, indicating a service termination with an error. The rule identifies critical services by their display names (which can be language-specific) or by their wide hex-encoded service names in the 'Binary' field of the event.
This rule detects when the Sysmon service crashes, indicated by an 'Application Popup' event with EventID 26 and a caption explicitly mentioning 'sysmon.exe - Application Error' or 'sysmon64.exe - Application Error'. This could signify an attempt to impair or disable Sysmon, which is a critical defense mechanism for endpoint monitoring.
This rule detects suspicious execution of 'Powercfg.exe' to modify power settings related to the lock screen timeout. Adversaries may use this technique to prevent a system from entering a dormant state, thereby maintaining access and hindering defensive mechanisms. The rule specifically looks for command-line arguments that change the AC (alternating current) or DC (direct current) standby timeout, or modify the video display timeout when the system is locked.
This rule detects the deletion of the 'SD' (Security Descriptor) value within the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\` registry hive. This action is typically performed by adversaries to hide scheduled tasks, making them less visible to standard enumeration tools. This technique has been observed in use by the Tarrask malware.
Detects applications attempting to modify the Windows Registry to disable write protection for storage devices. This activity can precede ransomware attacks or other malicious data manipulation, as observed with certain threat groups.
Detects when the "Index" value of a scheduled task is removed or deleted from the Windows Registry. This action effectively hides the scheduled task from standard tooling like "schtasks /query", making it a defense evasion technique.
Detects when the "Index" value of a scheduled task is modified in the registry to "DWORD (0x00000000)". This modification effectively hides the scheduled task from standard tooling like "schtasks /query", making it harder for defenders to discover.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
This rule detects attempts to disable the Windows Firewall using PowerShell. It specifically looks for PowerShell process creations that include commands to set the NetFirewallProfile to 'False' for any profile ('All', 'Public', 'Domain', or 'Private'). This activity is often performed by adversaries to bypass host-based firewalls and facilitate further malicious activity.
Detects attempts to unload the Sysmon filter driver using 'fltmc.exe'. This activity is often indicative of an adversary trying to impair defenses and remove forensic evidence by disabling Sysmon's monitoring capabilities.
Page 15 of 15