Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects persistence and fileless execution techniques associated with the MYRA Linux RAT. This includes monitoring for the creation of persistence files such as /usr/local/lib/.libcache.so for LD_PRELOAD hijacking and /etc/profile.d/.sh.local for shell-based persistence. It also monitors for suspicious process execution patterns where 'node' spawns a 'systemd-userdbd' masquerading process or invokes syscalls indicative of fileless execution, specifically memfd_create or fexecve.
Detects evidence of the Havoc Demon agent performing process injection into explorer.exe. The detection looks for a sequence of events: first, a suspicious process (excluding explorer.exe and userinit.exe) opening a handle to explorer.exe, followed by a cross-process thread creation event originating from the same source process against the same target.
Detects the deletion of a storage bucket immediately followed by the creation of a new bucket with the same name across different cloud providers (GCP, AWS S3, Azure). This rule specifically flags scenarios where the deleting actor or project differs from the creating actor or project, indicating a potential cross-account hijack or data exfiltration attempt.
This rule detects a potential Azure storage account name hijacking scenario. It identifies instances where a storage account is deleted and then recreated with the exact same name in a different subscription within the same Azure tenant, all within a 60-minute window. This activity could indicate an attempt to exfiltrate data via Azure Monitor diagnostic settings by taking over a previously used storage account name.
Detects the installation of the OpenSSH Server feature or the creation of an 'sshd' service on Windows workstations. Adversaries may install OpenSSH as a persistent, covert backdoor to maintain access to a compromised host.
Detects anomalous frequency of UAC elevation prompts (consent.exe) initiated by PowerShell. This behavior is indicative of privilege escalation attempts, specifically matching the pattern of repeated Start-Process -Verb RunAs usage to solicit user interaction for UAC elevation.
Detects the ClickOnce payload attempting to spawn the UAC consent.exe dialogue to elevate its privileges post-install.
Detects the creation of scheduled tasks using schtasks.exe that point to high-risk directories (Temp, AppData, ProgramData) or utilize obfuscated PowerShell commands (encoded parameters). This behavior is often associated with adversary persistence or initial execution.
This rule detects the execution of obfuscated PowerShell commands (encoded) that subsequently establish an external network connection and perform process injection within a short timeframe (120 seconds). This behavior is characteristic of malicious staged execution, where a PowerShell script acts as a dropper or loader to fetch secondary payloads and inject them into other processes for evasion.
This rule correlates three suspicious behaviors occurring within 10 minutes: a non-root process identified as 'bumsrakete' executes, this process accesses the sensitive kernel memory file '/dev/mem', and subsequently, a root process is spawned that is not a standard privilege escalation utility (such as sudo, su, etc.). This sequence of events is highly indicative of potential malicious activity, such as kernel-level exploitation or unauthorized privilege escalation.
Detects when fodhelper.exe, a legitimate Windows utility, is used to spawn processes other than cmd.exe or conhost.exe. This behavior is commonly associated with UAC bypass techniques where fodhelper.exe is abused to execute arbitrary commands with elevated privileges without a UAC prompt.
This rule detects attempts to manipulate user or service principal names (SPN/UPN) in Active Directory by adding non-ASCII or zero-width characters. Such modifications can be used by adversaries for obfuscation, to bypass detection mechanisms, or to create stealthy persistence. The rule specifically looks for Event IDs 4738 (User Account Changed) and 5136 (Directory Service Object Modified) where the 'servicePrincipalName' or 'userPrincipalName' attributes contain characters outside the standard ASCII range or zero-width characters like U+200B, U+200C, U+200D.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
Detects the creation of a named object with the specific name 'MakeAmericaGreatAgain'. This string has been associated with various malware and potentially unwanted programs, often used as a mutex or other synchronization object to ensure only one instance of the malicious process is running.
Identifies .lnk files dropped into Startup folders, a persistence technique tied to WinRAR exploitation.
Detects execution of CRYPTBASE.dll from non‑system directories, a technique used in the STX RAT campaign to hijack legitimate installers (e.g., CPUID HWMonitor, X‑VPN).
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
DHCP CalloutDLL
S1QL
Detects installation of a Callout DLL via CalloutDlls and CalloutEnabled registry parameters, which can be abused to execute code in the DHCP server context.
DHCP CalloutDLL
S1QL
Detects installation of a Callout DLL via CalloutDlls and CalloutEnabled registry parameters, which can be abused to execute code in the DHCP server context.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Page 108 of 401