Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects potential Antimalware Scan Interface (AMSI) bypass attempts where a process loads amsi.dll followed by suspicious memory modification operations (e.g., VirtualProtect, WriteProcessMemory) targeting the AmsiOpenSession function or the amsi.dll memory space. This is a common technique used by malware like DcRAT and various loaders to neutralize endpoint security visibility.
Detects User Account Control (UAC) bypass attempts where a registry key (e.g., ms-settings, mscfile, or Folder shell open command) is created or modified in HKCU, followed within 2 minutes by the execution of an elevated child process (High or System integrity level) by known auto-elevating binaries: fodhelper.exe, computerdefaults.exe, or eventvwr.exe.
This rule detects malicious activity associated with the TONResolver RAT, which leverages node.exe to execute JavaScript payloads stored in AppData\Local\Nodejs. The rule monitors for multiple suspicious behaviors, including outbound C2 beaconing to known malicious domains, spawning of suspicious child processes (powershell.exe, cmd.exe, wscript.exe, cscript.exe), unauthorized access to browser-based credential stores (Login Data and Cookies), and establishment of persistence via Windows Registry Run keys.
Detects modifications to Windows Registry Run keys (HKCU or HKLM) by suspicious processes (cmd, powershell, wscript, cscript, node). The detection specifically looks for cases where the written value points to a binary located in user-writable or temporary directories and the binary itself is unsigned or has low trust, indicating a potential persistence mechanism being established.
Detects potential User Account Control (UAC) bypass attempts where a process hijacks registry keys associated with 'ms-settings' or 'mscfile' handlers (commonly used for auto-elevating binaries) and subsequently executes an arbitrary binary from a suspicious location like AppData or Temp.
This rule detects potential DLL sideloading by identifying signed executables that load unsigned DLLs from user-writable directories, such as Temp, AppData, Downloads, or Documents. It excludes loads from standard, protected Windows directories to reduce noise.
This rule detects potential persistence attempts by monitoring for the execution of 'schtasks.exe' with the '/create' flag or the loading of 'taskschd.dll' by suspicious parent processes. These parents include script interpreters (e.g., powershell, wscript), Microsoft Office applications, and various living-off-the-land binaries or web-related utilities, which are commonly abused by adversaries to establish persistence via the Windows Task Scheduler.
Detects when a single session identifier is used to access multiple cloud applications, where at least three distinct applications are accessed within an hour, and these applications were not part of the original interactive sign-in. This behavior can indicate a token replay attack, specifically as described in the Elastic Security Labs research on Tycoon 2FA AiTM detection engineering.
Detects attempts to modify or delete Conditional Access Policies in Microsoft Graph. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
Detects exploitation of CVE-2026-25157 where the OpenClaw AI agent is manipulated to execute arbitrary commands via a malicious SSH target string. The vulnerability allows an attacker to inject command-line options like '-oProxyCommand' into the SSH client, leading to local command execution.
Detects remote support software being added to common user or machine Run and RunOnce registry persistence locations. This rule specifically looks for modifications or creations within the 'Run' and 'RunOnce' registry keys that contain strings associated with known remote access or management tools such as AnyDesk, Bomgar, BeyondTrust, Zoho, ScreenConnect, Splashtop, Atera, SuperOps, and TeamViewer. This activity could indicate an attacker establishing persistence on a compromised system.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
Detects the execution of 'code.exe' with 'tunnel service install' command-line arguments, initiated by 'WINWORD.EXE'. This activity indicates an attempt to install a persistent tunnel service, potentially as part of a phishing attack chain.
Detects when a legitimate application, specifically 'pdf24.exe', loads 'cryptbase.dll' from a non-standard directory. This behavior is indicative of DLL side-loading, a technique known to be used by the PDFSIDER malware to evade detection and potentially escalate privileges.
Detects the loading of the system dynamic link library USER32.dll by a process executing from a suspicious directory within AppData\Roaming\Traiolx Custom Utils\. This behavior is consistent with potential DLL side-loading or process injection attempts where a process residing in a non-standard or user-writable location attempts to interact with critical OS system modules.
Identifies the addition of the 'Visual Studio Code Tunnel' value under the HKCU Run key, establishing a persistence mechanism. This could indicate an attacker attempting to maintain access to a compromised system by ensuring Visual Studio Code Tunnel starts automatically.
This rule detects command line patterns associated with Cobalt Strike Beacon injection, specifically looking for indicators of 'beacon.dll', 'beacon.exe', or 'injection' strings being executed by suspicious parent processes such as explorer.exe, svchost.exe, or winlogon.exe. This activity is indicative of post-exploitation behavior and potential lateral movement or persistence attempts.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an `AppData` directory.
Detects the creation of scheduled tasks using schtasks.exe, where the command line arguments reference known LOLBins (Living Off the Land Binaries) such as certutil, regsvr32, mshta, wscript, cscript, rundll32, or encoded command execution via cmd.exe. This activity often indicates an attempt to establish persistence or execute malicious code using trusted system binaries.
Page 117 of 401