Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Detects a RedVDS login followed by commands modifying domain trusts or attempting Active Directory Certificate Services (AD CS) abuse within a 2-hour window. The rule specifically looks for 'Certify.exe' or 'nltest /domain_trusts' commands after a login from a predefined RedVDS IP range.
This rule detects modifications to Group Policy Objects (GPOs) that involve sensitive attributes such as logon scripts, startup/shutdown scripts, or file system paths, particularly when performed by service accounts or non-administrator users. This activity is a common indicator of persistence mechanisms or lateral movement via GPO abuse.
Detects an unprivileged process executing from a user-specific temporary directory with the 'RP_' prefix, while simultaneously interacting with specific file patterns in 'C:\Windows\Temp'. This behavior is consistent with the 'RoguePlanet' Time-of-Check to Time-of-Use (TOCTOU) exploit, which uses junction-swap techniques to manipulate Defender quarantine workflow files to achieve privilege escalation.
Detects activity associated with the BRICKSTORM threat actor, including known malicious ELF binary execution, unauthorized file path utilization, and suspicious DNS-over-HTTPS (DoH) network traffic directed to public DNS resolvers.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for modifications to specific registry keys (ms-settings\Shell\Open\command) followed by the execution of known auto-elevating Windows binaries like 'fodhelper.exe' or 'computerdefaults.exe'. The rule correlates the registry modification with a subsequent process creation from an suspicious location, indicating a likely attempt to gain elevated privileges.
This rule detects the execution and creation of suspicious files named 'winupdate.exe' or 'SLaunch.exe' within the AppData cache directory, or processes involving 'YutaCore.dll' or a specific local host URL. It also checks for the execution of known malicious file hashes associated with this behavior.
Detects anomalous activity involving the Windows Error Reporting service executable, wermgr.exe. This includes the suspicious creation of files within temporary directories that match known junction-based exploitation techniques, the creation of a 'wdtest_temp' subdirectory (often used as a working directory in exploit staging), and the execution of wermgr.exe from a path other than the expected Windows System32 directory.
Detects unauthorized access to wermgr.exe residing within Volume Shadow Copy paths or staged in specific temp directories. This behavior is associated with the RoguePlanet exploit, which uses this pattern to obtain SYSTEM-readable handles for subsequent oplock placement and TOCTOU (Time-of-Check Time-of-Use) race conditions to achieve privilege escalation.
Detects the loading of amsi.dll by potentially malicious Python-based processes (e.g., PyInstaller, scripts) or cross-process memory writes from such processes, which are indicative of in-memory patching of AMSI (AmsiOpenSession) or ETW (EtwEventWrite) to evade detection. The rule monitors for unsigned processes like 'python.exe' or 'winupdate.exe' performing these actions.
Detects a Google account completing an OAuth or MFA challenge and then generating a new session from a different client fingerprint (different source IP or user agent) within a 10-minute window. This behavior can indicate a session hijack or an adversary bypassing MFA.
Detects the RoguePlanet exploit chain where an attacker-planted binary masquerading as wermgr.exe is executed by the QueueReporting scheduled task under SYSTEM integrity and spawns an interactive shell process (conhost.exe, cmd.exe, powershell.exe). Legitimate wermgr.exe instances related to error reporting do not spawn interactive console processes.
Detects anomalous execution of chrome.exe as a child process of Python interpreters or PyInstaller-compiled binaries running from non-standard, user-writable directories. This pattern is indicative of the Glove Stealer malware attempting to perform a Chrome App-Bound Encryption (ABE) bypass by injecting a decryption helper DLL into a suspended chrome.exe process to exfiltrate master keys.
Detects the loading of amsi.dll into processes running from user-writable, temporary, or PyInstaller-specific staging directories. This behavior is indicative of the Glove Stealer payload attempting to disable security telemetry by patching AmsiOpenSession and EtwEventWrite to blind AMSI and ETW monitoring.
Detects unauthorized processes attempting to interact with the elevation_service.exe (the Chrome App-Bound Encryption service) via COM mechanisms. This activity is a known indicator of the Glove Stealer 'five-tier ABE bypass' technique, which is used to decrypt browser-stored credentials and session cookies by abusing the service's interface.
Detects the creation of UUID-named files within RoguePlanet staging directories (RP_<UUID>) under the %TEMP% path. This activity is indicative of Poseidon thread I/O saturation, a technique used to artificially extend the TOCTOU (Time-of-Check to Time-of-Use) race condition window against the Microsoft Defender service (MsMpEng.exe) as part of an exploit for CVE-2026-50656.
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
Page 105 of 401