Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects when GitHub's push protection feature is disabled. This feature helps prevent sensitive information, such as secrets, from being accidentally committed to repositories. Disabling it could indicate an attempt to bypass security controls, potentially allowing secrets to be exposed in code.
This rule detects when a repository within Bitbucket is configured to be exempt from secret scanning. This action could indicate an attempt to bypass security controls and hide sensitive information or malicious code within the repository without detection.
Detects when a user bypasses the push protection on a secret detected by secret scanning in GitHub. This indicates an attempt to commit code containing sensitive information despite automated safeguards.
Detects changes to the Bitbucket audit log configuration. This could indicate an adversary attempting to disable or modify logging to evade detection.
Detects when the global SSH access configuration is changed within Bitbucket. This could indicate an attempt to enable or modify SSH access for malicious purposes, potentially for lateral movement or persistence.
Detects when a global secret scanning rule is deleted in Bitbucket. This activity could indicate an adversary attempting to disable security controls to prevent detection of sensitive information exposure.
Detects when a secret scanning allowlist rule is added for projects in Bitbucket. This could indicate an attempt to bypass security controls by allowing certain secrets to be ignored by the scanning mechanism.
This rule detects when a secret scanning rule is deleted within Bitbucket for either a project or a repository. This action could indicate an attempt to bypass security controls by disabling mechanisms designed to detect sensitive information in code.
Detects when the secret scanning feature is disabled for a GitHub enterprise or repository. This action can indicate an attempt to evade security monitoring and hide the introduction of sensitive information into codebases.
This rule detects when an MDI (Microsoft Defender for Identity) sensor is deleted. This could indicate an adversary attempting to impair defenses by removing security monitoring tools.
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux. This includes using the `personality` syscall with the ADDR_NO_RANDOMIZE flag, modifying the `/proc/sys/kernel/randomize_va_space` file, or executing the `sysctl` command to set `kernel.randomize_va_space=0`. Disabling ASLR can be used by attackers to bypass memory protection mechanisms and make memory corruption attacks more reliable, often during exploit development.
Monitoring the execution of auditpol.exe can be crutial to detect first-stage of a real attack because they will be shown as previous steps to obfuscate the next execution such a ransomware.
Monitoring the execution of auditpol.exe can be crutial to detect first-stage of a real attack because they will be shown as previous steps to obfuscate the next execution such a ransomware.
Detects the use of PowerShell to add exclusions to Microsoft Defender, which can be an attempt by an adversary to impair defenses and prevent detection of malicious activities.
Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl.
This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.
This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.
Detects multiple TTPs associated with the exploitation of SharePoint ToolShell vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This includes the initial exploit attempt, webshell creation, defense evasion using a vulnerable driver, and C2 communication.
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.
This rule detects when Privileged Identity Management (PIM) alerts are disabled within Azure. Disabling PIM alerts can be a defense evasion tactic, as it prevents security teams from being notified of critical activities related to privileged roles, potentially allowing an attacker to operate undetected after gaining initial access or escalating privileges.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging within .NET processes by modifying specific registry keys. Adversaries may perform this action to evade detection by security tools that rely on ETW for monitoring .NET activity. The rule specifically looks for modifications to the 'ETWEnabled' and 'ETWFlags' registry keys under 'SOFTWARE\Microsoft\.NETFramework' or 'COMPlus_' prefixed keys, setting their values to '0' (disabled). This indicates an attempt to prevent the recording of loaded .NET assemblies and other relevant ETW events, thereby hindering security monitoring capabilities.
Detects attempts to freeze a process, likely an EDR or an antimalware service process, through EDR-Freeze that abuses the WerFaultSecure.exe process to suspend security software. The rule specifically looks for WerFaultSecure.exe being executed with a particular set of command-line arguments that are indicative of the EDR-Freeze tool's behavior, including '/h', '/pid', '/tid', '/encfile', '/cancel', '/type', and '268310'.
Page 36 of 60