Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects PowerShell excluding targeted mining executables and RuntimeHost.exe from Microsoft Defender Antivirus scans. This activity is indicative of cryptojacking campaigns attempting to evade detection.
Detects attempts to unload, disable, or remove kernel drivers, which could indicate a rootkit or other malicious activity trying to hide its presence or impair system defenses. The rule specifically looks for process creation events (EventID 4688) where the command line contains keywords related to driver manipulation ('unload driver', 'disable driver', 'remove driver') and also references kernel components ('.sys', 'kernel').
Detects modification of AWS organizational units to evade policy controls
Detects disabling of AWS CloudTrail audit logging
Detects disabling of Windows Defender through registry modifications
Detects addition of AV exclusion paths to hide malicious files from scanning
Identifies PowerShell executing a script block directly from the specific environment variable 'INTERNAL_DB_CACHE', as observed in the Evil MSI Background steganography campaign. This technique is used to hide malicious PowerShell code within an environment variable and execute it, bypassing direct script file detection.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
Detects commands used to disable or impair security defenses
This rule detects attempts to stop the Microsoft Defender Antivirus service (MsMpEng) remotely via the Server Message Block (SMB) protocol on port 445. The detection is triggered by the presence of "StopService" and "MsMpEng" (case-insensitive) within the TCP payload, indicating a potential defense evasion tactic.
Detects modification of macOS plist files to hide processes or enable autostart
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
Detects the execution of taskkill.exe targeting the iediagcmd.exe diagnostic tool. This defense evasion action is performed by the PlugX payload prior to establishing a C2 communication channel to prevent network diagnostic monitoring.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects an unusually high volume (10 or more within an hour) of permission changes to files or registry keys by a single user. This activity can be indicative of an adversary attempting to modify access controls to facilitate persistence, privilege escalation, or defense evasion.
Detects registry modifications designed to disable automatic system reboots and scheduled maintenance, preventing the system from interrupting destructive actions, as observed with BLUERABBIT.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the creation or modification of a VSCode package.json file that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting the 'skipPublisherTrust' flag to true. This technique can be used by adversaries to install malicious VSCode extensions without publisher trust checks, potentially leading to supply chain compromise or defense evasion.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
This rule links changes that weaken Windows Defender with a rapid series of network discovery commands. Attackers often turn down protections before mapping the network for ransomware. Treat this sequence as active compromise. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Explorer File Visibility Downgrade
Cortex XDR
Detects modifications to Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) to conceal files. This technique is often used by malware, such as GammaWorm, as a defense evasion mechanism to hide malicious artifacts from users and security tools. The rule specifically looks for changes to the 'Advanced' registry key path within 'Software\Microsoft\Windows\CurrentVersion\Explorer' that would result in files or file extensions being hidden.
Page 26 of 60