Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
746 detections
Filters
Last updated
All Time
Detection languages
368
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
297
143
135
93
Platforms
648
48
24
21
15
Products / Services
189
177
145
133
132
MITRE Techniques
18,098
15,553
12,544
8,358
6,159
746
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
This rule detects modifications to Google Cloud Platform (GCP) Cloud DNS managed zones, including creating, deleting, patching, updating, or changing records within a managed zone. It performs triage by categorizing the actor as either a human or a service account, checks for the use of Infrastructure-as-Code (Terraform), and flags potentially anomalous activity such as service accounts interacting with DNS outside of expected networks or without using automated tooling.
This rule detects potential adversary activity aimed at disabling security tools, critical infrastructure services, or cloud synchronization agents. It monitors for a high volume (6 or more) of process termination commands (e.g., taskkill, net stop) or registry-based service disabling (Start value 4) targeting a predefined list of security and critical system services within a 3-minute window, which is indicative of an attempt to blind security monitoring or disrupt system availability.
Detects a sequence of potentially malicious activities on a Windows host: a batch script command referencing AMSI bypass, followed within 30 minutes by a registry modification affecting Windows SmartScreen settings, and culminating in a silent MSI installation (msiexec.exe /qn). This pattern is consistent with an adversary attempting to disable security controls to facilitate an stealthy software installation.
Detects operations that remove, disable, delete, or update billing limits, spending limits, usage alerts, spend notifications, billing thresholds, or cost alerts on AI service accounts, which may indicate an attacker attempting to remove financial guardrails to enable unrestricted abuse of stolen AI API credentials.
Detects G12clean.exe creating a kernel driver file (drv.sys or anticheatG13.sys) while its own command line references the XOR key 0xAB, consistent with decoding and dropping an obfuscated driver payload.
Detects the use of PowerShell cmdlets 'Set-MpPreference' to disable real-time monitoring or 'Add-MpPreference' to add exclusion paths. The rule specifically alerts on these actions when accompanied by obfuscation or hidden execution flags, identifying behavior common to defense evasion tactics used by malware like the Larva-24009 backdoor. Legitimate management tools (e.g., SCCM, Intune) are excluded.
Detects driver-level WFP filter/callout registration at network-redirection-relevant layers that can be used to redirect or interfere with security-vendor network traffic (G12 capability).
Detects a full defense-evasion sequence against the drvsvc kernel service and its drv.sys driver: stop, poll, delete, and re-drop occurring within a short time window.
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Detects a cross-process kernel memory write primitive invoked via IOCTL control code 0x22209C, where the initiating process is unsigned and the write targets a process other than itself.
Detects multiple G13-related artifacts (anticheatG13.sys, drv.sys, WindowsData*.log) dropped into Windows Temp or drivers directories within a 15-minute window by the same unsigned initiating process.
This rule detects the execution of processes associated with G12/G13 EDR-killer tools. These tools are specifically designed to automate the termination of security software, antivirus solutions, and remote management processes, which is a common tactic used by adversaries to evade detection and maintain persistence.
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
Detects reconnaissance of system security posture by unsigned or unknown processes. The rule monitors for a combination of AV/EDR product enumeration (SecurityCenter2, Windows Defender exclusion queries), RDP history collection, Office MRU collection, and general system information gathering. It correlates two or more of these activities originating from the same process within a 15-minute window, while excluding known legitimate security and management software.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects HollowMare variants (OneZip/CrystalPDF/PowerDoc) that terminate a running Chrome or Firefox process immediately before overwriting a browser profile configuration file (Preferences, Secure Preferences, prefs.js) with a C2-supplied version to hijack the default search engine.
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
Detects invocation of the G13 killer driver's WipeProcessUserMemory routine via IOCTL 0x221E64, requiring the wipe target be a distinct, identified process from the process that issued the IOCTL.
Page 27 of 36