Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
Detects the creation of Kubernetes pods where the 'hostPID' or 'hostNetwork' settings are enabled. These configurations allow a pod to share the host's process namespace or network stack, respectively, which are common vectors for container escapes and host-level privilege escalation.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow. This could indicate an attacker attempting to gain access to an account by resetting its password without proper authorization.
Detects execution of a SimpleRunPE-style loader from common user-writable directories such as Downloads, Temp, AppData, or Public paths. This behavior is often associated with malware attempting to evade detection by executing from non-standard locations.
Detects the LokiBot information stealer establishing persistence via a Windows Run key. The detection looks for registry key modifications under HKCU that follow a specific pattern: the registry value points to an executable located within the %APPDATA% directory inside a short, six-character hexadecimal subdirectory. The rule further validates this behavior by monitoring for key names derived from the C2 infrastructure components, such as IP addresses or specific PHP script names, commonly observed in builder-generated LokiBot samples.
Detects outbound network connections from the aspnet_compiler.exe process. This process is often abused by malware like LokiBot as a host for malicious payloads through process injection to establish C2 communication, as it has no legitimate need for external network connectivity.
Detects the creation or modification of a Windows service configured for automatic startup under the LocalSystem account that references the GitLab Runner executable. This pattern is commonly used for persistence via CI/CD runner abuse, including threats like the Shai-Hulud worm.
Detects Remcos RAT attempting to bypass User Account Control (UAC) by abusing the ICMLuaUtil COM interface (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). The rule identifies potential elevation by monitoring for processes executing under a High integrity level that originated from known Remcos installation paths or binary names, as well as registry access to the specific malicious CLSID.
Detects indicators of abuse involving remote monitoring and management (RMM) tools like AnyDesk and N-able. The rule identifies suspicious LNK files masquerading as software configuration, configuration files placed in non-standard locations, the addition of RMM components to Windows Registry run keys, and the execution of RMM agents with silent flags, all of which are common tactics for establishing persistence and unauthorized remote access.
Detects the creation or modification of a file named 'System.dll' within a subdirectory of the 'C:\Windows\Temp' directory where the writing process is not signed by Microsoft. This behavior is indicative of potential DLL sideloading or masquerading attempts, where an attacker drops a malicious DLL in a writable directory to be loaded by a legitimate process.
Detects various methods employed by LCRYX ransomware to disable security software and firewall configurations. The rule identifies suspicious process executions, including PowerShell commands to modify Windows Defender settings, netsh commands to disable firewalls, sc.exe commands to stop security services, and the termination of various antivirus processes (e.g., MsMpEng.exe, avp.exe, bdagent.exe) via taskkill. It specifically monitors these actions when spawned from script hosts like wscript, cscript, or shells like powershell and cmd.
This rule detects the execution of PowerShell with parameters indicating an attempt to elevate privileges using 'Start-Process -Verb RunAs'. This technique can be used to bypass User Account Control (UAC) and execute commands with administrative privileges.
This rule detects multiple indicators associated with the deployment of unauthorized or malicious Remote Monitoring and Management (RMM) tools, specifically focusing on impersonated shortcut files, suspicious command-line execution patterns, registry-based persistence mechanisms, and the presence of configuration files for remote access software like AnyDesk.
This rule detects the creation of 'system.dll' or 'shfolder.dll' files within Windows or AppData temporary directories. These specific filenames are frequently associated with DLL sideloading or search order hijacking techniques where malicious DLLs are masqueraded or placed in writable user-space folders for execution by legitimate processes.
This rule detects the creation of a scheduled task using 'schtasks.exe' that includes a PowerShell command with 'invoke-expression' (iex) and 'invoke-restmethod' (irm) to ensure persistence across reboots. This behavior is characteristic of the DeepLoad malware, often delivered via ClickFix campaigns.
Detects ffmpeg or ffprobe spawning unexpected child processes such as /bin/sh as a result of the MagicYUV OOB write hijacking the AVBuffer.free function pointer to call system() — a key indicator of CVE-2026-8461 exploitation.
Detects process parent ID (PPID) spoofing where a process spawned by SystemSettings.exe claims a parent that is not SystemSettings.exe, svchost.exe, services.exe, or explorer.exe. This behavior is indicative of SharkLoader attempting to disguise Cobalt Strike Beacon process lineage using UpdateProcThreadAttribute/PROC_THREAD_ATTRIBUTE_PARENT_PROCESS. The rule also looks for suspicious process paths associated with SharkLoader.
Detects attempts to stop, disable, delete, or configure the Sysmon service using standard administrative utilities (sc.exe, taskkill.exe, or PowerShell). Attackers often perform these actions to blind defensive visibility before executing further malicious activity.
Detects modification or replacement of a trusted-looking executable or DLL located in a directory writable by standard users. This rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file is an executable (.exe) or dynamic link library (.dll) and is located in common world-writable directories such as \Users\Public\, \ProgramData\, \AppData\, or \Temp\. Additionally, it filters for processes whose command line or base file name suggests a loader, updater, or common command-line utilities (cmd.exe, powershell.exe) initiating these writes, indicating potential masquerading or DLL hijacking.
Detects regsvr32.exe loading DLLs from user-writable directories such as Temp, AppData, ProgramData, Downloads, Desktop, and Public. Legitimate DLL registration runs from System32 or Program Files - execution from these paths indicates LOLBin abuse for proxy execution, DLL sideloading, or defense evasion commonly used to launch malware payloads.
Page 115 of 401