Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects the creation of a 'WSPrint' scheduled task followed by deletion of its Security Descriptor (SD) registry value. Deleting the SD value hides the task from schtasks /query and Task Scheduler. This technique is used by UAT-9244 for stealthy persistence and is also associated with HAFNIUM/Tarrask.
Detects PowerShell commands used by Prometei to add Microsoft Defender exclusions for its staging and configuration directories ('C:\Windows\Dell' or 'Intel\Support'). This is a common defense evasion tactic.
Detects the creation or modification of a Claude Code settings file (`.claude/settings.json`). This file can be configured to automatically approve Model Context Protocol (MCP) servers by setting `enableAllProjectMcpServers` to `true` or by using `enabledMcpjsonServers`. This bypasses security prompts designed to warn users about potential command execution, which can lead to Remote Code Execution (RCE) as described in CVE-2025-59536.
Detects attempts to disable Windows Credential Guard by modifying the 'LsaCfgFlags' registry value. Credential Guard uses virtualization-based security to isolate secrets, and disabling it is a common defense evasion technique used by adversaries to access credentials for lateral movement.
Detects the loading of specific vulnerable drivers ('zam64.sys', 'UpdateCheckerX64.sys') used by ransomware groups like CrazyHunter and Interlock to terminate security products. The query combines multiple data sources to detect different stages of BYOVD activity, including driver file creation, registry entries for service creation, and command-line activity related to driver loading.
This rule set detects indicators of compromise associated with the RESURGE activity targeting Ivanti Connect Secure devices, as described by CISA. It looks for specific file hashes, the presence of a covert socket path (.logsrv), and modifications to key Ivanti filesystem artifacts such as LD_PRELOAD, DSUpgrade.pm, coreboot.img, and scanner.py. A match indicates potential compromise and requires further investigation to confirm the asset role, timing of file appearance, and comparison with approved maintenance windows. If hits are found, collect logs and file copies, reduce external exposure, and look for unusual activity like unexpected administrator actions or unfamiliar outbound connections.
Detects the modification of the 'check_integrity.sh' script to replace 'exit 1' with 'exit 0'. This is a specific defense evasion technique used by the RESURGE malware on Ivanti Connect Secure devices to ensure the compromised system always appears healthy during integrity scans.
Detects the use of the legitimate Windows binary 'SystemSettingsAdminFlows.exe' to spawn a child process that disables Windows Defender settings. This is a LOLBin technique used for defense evasion as observed in campaigns leveraging the Apache ActiveMQ exploit.
Detects the execution of 'chmod 000' against PHP files in common FreePBX/Elastix web server directories. This is a high-fidelity indicator of the EncystPHP web shell attempting to lock out administrators and prevent inspection of its malicious files.
The rule detects an object access event (Event ID 4663) initiated by Windows Defender, where the target file is located outside the legitimate Microsoft Defender directories (C:\Windows\System32\ or C:\ProgramData\Microsoft\), indicating potential usage of a tool like "EDRStartupHinder".
Detects attempts to modify the Boot Configuration Data (BCD) using bcdedit.exe. This rule specifically looks for commands that delete boot entries or values, enable safe boot with networking, disable recovery, or ignore boot status policy failures. Such modifications can be used by adversaries to establish persistence, evade defenses, or disrupt system recovery.
Detects action of Repo branch protection being disabled. This would mean no PR or review process is needed for that repo and an actor (Insider or attacker) could push arbitrary code. Bypassing usual Security controls.
The rule detects access attempts (Event ID 4663) to theAppIDSvc service object. This captures the moment a process interacts with the service's configuration, such as changing its startup type from "Manual" to "Auto" or forcing it to start.
The rule detects the execution of the devcon.exe process with a command-line argument containing the word "disable". This is a strong indicator that an attempt is being made to disable one or more hardware devices on the system, which is highly suspicious outside of legitimate administrative or deployment activities.
Detects action of SSH ertificate Auth being disabled. This would mean password auth is allowed.
This could indicate an Authentication downgrade attack, disabling Security controls.
This could indicate an Authentication downgrade attack, disabling Security controls.
The rule detects object access events (Event ID 4663) targeting files within the \Windows\System32\AppLocker directory. This identifies unauthorized attempts to read, write, or delete the system's application control policy cache, a behavior indicative of an attempt to tamper with endpoint security defenses.
Detects PowerShell launched with ExecutionPolicy Unrestricted and stdin command execution (-Command -), matching behavior described in fake Windows 11 installer campaign.
This rule detects DYNOWIPER malware. It uses two primary detection methods: 1. Known SHA256 hashes of DYNOWIPER samples as published in a report. 2. A string-based detection logic derived from CERT Polska, as reproduced in the Elastic DYNOWIPER reporting. This logic looks for specific strings related to file paths, error messages, and Windows API calls, combined with a check for the 'SeShutdownPrivilege' string and a file size constraint, within a PE file (identified by the 'MZ' header).
This rule detects PowerShell being used to add Windows Defender exclusions for file paths and processes associated with the ValleyRAT malware campaign. Specifically, it looks for `Add-MpPreference` command-line arguments that include `-ExclusionPath` with "trvePath" or `-ExclusionProcess` with "WavesSvc64.exe".
Detects PowerShell script content consistent with ETW disable (EventProvider.m_enabled) and AMSI bypass (AmsiUtils.amsiInitFailed) described in the MIMICRAT ClickFix chain.
Detects PowerShell scripts using .NET Reflection to modify internal fields to disable Event Tracing for Windows (ETW) or the Anti-Malware Scan Interface (AMSI). This technique is used by malware like the MIMICRAT loader to evade defenses before executing its main payload.
Page 32 of 60