Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,591 detections
Filters
Last updated
All Time
Detection languages
5,144
3,904
1,034
828
476
Contributors
2,488
1,655
1,442
1,403
970
Categories
3,456
1,830
1,659
1,579
1,415
Platforms
8,051
1,889
1,340
1,053
779
Products / Services
1,980
1,803
1,633
1,096
1,042
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
Detects potential COM object hijacking via modification of default system CLSID.
KQL Query
KQL Query from file: RID Hijacking Technique and Detection
KQL Query from file: Detecting Windows Downdate Abuse
KQL Query
SPL Query
Detects the creation or modification of a registry key under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, a common persistence mechanism used by DarkCloud Stealer.
KQL Query from file: Git Critical Vulnerability CVE-2024-32002
KQL Query
SPL Query from file: Failed Authentication to Non-existing Accounts
Detects the creation or modification of an Active Directory forest trust where the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag is set in TdoAttributes. This includes cases where it's set alone (0x800) or in combination with the FOREST_TRANSITIVE flag (0x808), both indicative of the AORTA attack. For more comprehensive detection, consider backend-specific bitwise checks on TdoAttributes to ensure the 0x800 bit is set, regardless of other flags.
Detects the use of 'bitsadmin.exe' to download files from domains commonly associated with file-sharing services or attacker-controlled infrastructure. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
KQL Query
This rule detects changes to the Windows Registry key that controls the Remote Desktop Protocol (RDP) port number. Specifically, it triggers when the RDP port is modified from its default value of 3389 to any other port. This activity can be indicative of an adversary attempting to evade detection, bypass network filtering, or maintain persistence by configuring RDP to listen on a non-standard port.
Researchers have identified a recurring issue where API keys, secrets, and authentication tokens are hardcoded within the JavaScript code of popular Chrome extensions. These exposed credentials are easily retrievable by inspecting the extension package, enabling threat actors to abuse associated services.
Detects the creation or modification of an Active Directory forest trust with only the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag set in TdoAttributes. This indicates the AORTA attack where TGT delegation is enabled without the trust also being marked as transitive. This complements the detection for the 0x808 value.
Detects potential AppDomainManager hijacking used by the OneClik APT campaign, where legitimate .NET ClickOnce applications (ZSATray.exe, umt.exe, ied.exe) load a suspicious DLL like 'history.tlb'. This technique (T1574.014) is used to load attacker-controlled assemblies and execute malicious code.
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc
Detects the creation of a new Active Directory forest trust with both FOREST_TRANSITIVE (0x00000008) and CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flags set, indicative of the AORTA attack. This rule specifically checks for the TdoAttributes value 0x808, which represents the exact combination of these two flags. Attackers might set additional flags, which would result in a different TdoAttributes value, potentially leading to false negatives. Consider implementing backend-specific bitwise checks if your SIEM supports them for more comprehensive detection.
Page 476 of 600