Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the creation, modification, or renaming of the `authorized_keys` file within the `.ssh` directory by processes other than common SSH key management or shell utilities. This activity could indicate an adversary attempting to establish persistence or elevate privileges by adding their own public key for SSH access.
Detects when a non-root user modifies, creates, or renames files within common cron directories or the main crontab file on Linux systems. This activity can indicate an attempt to establish persistence or schedule malicious tasks.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the creation or modification of Windows Registry Run keys that point to common LOLBins (Living Off the Land Binaries) like PowerShell, WScript, or MSHTA. This activity is often used for persistence, and the rule specifically excludes Microsoft-signed binaries to reduce false positives.
Detects the creation of a scheduled task via schtasks.exe that executes a command interpreter or script engine (e.g., PowerShell, cmd, wscript) where the parent process is not signed by Microsoft. This behavior is often associated with the execution of malicious payloads, persistence mechanisms, or lateral movement.
Detects the 'node' process creating hidden JavaScript or native loader files (e.g., .js, .node, .so, .dylib, .bin) in user profile or temporary directories. This activity is indicative of the OpenClaw malware's staging phase, where it drops its components for persistence or further execution.
Detects the Miasma worm propagating through CI/CD pipelines by identifying unauthorized updates to GitHub Actions workflow files. Specifically monitors for modifications to workflows under the LeoPlatform or LeoInsights projects by the compromised user 'czirker', with signs of weaponization such as the addition of OIDC id-token write permissions and npm-publish capabilities.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation. This behavior is indicative of an attacker using a stolen device code to register a new device, thereby gaining persistent access to the user's account.
Detects anomalous logins (impossible travel/session anomalies) utilizing the Kali365 Live desktop application User-Agent combined with IP shifting. This rule identifies instances where a user logs in with the 'kali365-live/1.0.0' User-Agent from an IP address different from a previous successful login by the same user within a 4-hour window, where the previous login used a different User-Agent.
Detects sign-ins utilizing the Kali365 Live desktop application User-Agent, which is associated with the EvilTokens threat actor tooling. This rule specifically looks for the User-Agent string "kali365-live/1.0.0" in sign-in logs.
This rule detects modifications to SSH authorized_keys files on Linux-based SD-WAN controllers, or successful SSH public key authentication events involving the vmanage-admin user, including attempts to identify authentication from unexpected source IP addresses.
Detects modifications to common Windows Registry Run keys (Run, RunOnce, RunServices, RunServicesOnce) that include specific keywords ('ManageEngine', 'SystemOptimizer') and reference scripting tools ('wscript', 'cscript', 'powershell', 'cmd') in the RegistryValueData. This pattern is often used by adversaries to establish persistence on a system by ensuring their malicious scripts or commands are executed upon user login or system startup.
Detects various methods of establishing persistence on Linux systems by abusing dynamic linker configuration (/etc/ld.so.preload), modifying shell startup profiles (.bashrc, .profile) to include malicious environment variables (LD_PRELOAD/LD_LIBRARY_PATH), or directly launching processes with these hijacked variables pointing to suspicious locations such as /tmp, /dev/shm, or /var/tmp.
This rule detects potentially malicious cron job activity, including modifications to crontab files, execution of cron jobs from world-writable directories (such as /tmp or /dev/shm), and the usage of unusual prime-number timing intervals which are commonly used by attackers to evade standard scheduling patterns.
Detects modifications to .git/hooks/pre-commit files across developer workspaces, which is a primary persistence mechanism ensuring payload re-execution on git commits.
Detects the creation of ActiveScriptEventConsumer bindings via WMI process executions, a fileless persistence mechanism used by Showboat malware to survive reboots. The rule specifically looks for 'scrcons.exe' processes with command-line arguments containing 'ActiveScriptEventConsumer' or '__EventFilter'.
Detects modifications to the 'Run' registry key for persistence, specifically looking for indicators associated with Prinz Eugen ransomware such as 'servertool', 'encrypt.exe', 'lock.exe', or 'ransom' in the registry value data. It excludes common legitimate paths to reduce false positives.
Detects an attempt to bypass User Account Control (UAC) consistent with the Millenium RAT. The rule monitors for the spawning of cmd.exe from non-standard, user-writable directories (such as AppData or Temp) where the parent process launches the shell using the runas verb via ShellExecuteExW with a hidden window, often accompanied by silent command execution.
This rule detects the execution of DcRAT by monitoring for its unique single-instance mutex 'Global\ShitSetupOn26126k' or the execution of processes known to be associated with DcRAT, specifically 'Mixed Reality.exe' in common locations or masquerading under the provided file name.
This rule monitors for modification of Windows Registry Run keys (a common persistence mechanism) by node.exe or powershell.exe, specifically targeting paths related to local Node.js installations. This behavior is indicative of an adversary attempting to establish persistence by setting an executable to run automatically upon user logon.
Detects a sequence of sensitive Windows API calls (AllocateAndInitializeSid, CheckTokenMembership, or ShellExecuteW with runas) occurring within the same process on a host. This behavior is indicative of privilege escalation attempts or unauthorized token manipulation, often observed in malicious processes attempting to elevate privileges or verify token permissions.
Page 116 of 401