Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects Potato attack tools for Windows privilege escalation
Detects a batch or script artifact that creates a scheduled task named 'ApphostRagistreationVerifier' (a likely typo for 'ApphostRegistrationVerifier') which is configured to execute a file located within the 'Windows\Fonts\' directory. The detection specifically looks for the presence of 'schtasks' command, 'ONSTART' trigger, and 'SYSTEM' user context, indicating a persistent scheduled task.
Detects a persistence script querying for a missing task or payload and recreating it when absent, indicating self-repair behaviour. This rule specifically looks for command-line activity involving 'powershell', 'cmd', or 'schtasks.exe' that queries for scheduled tasks and then attempts to create or register them, often using keywords like 'if', 'missing', 'not found', 'create', or 'Register-ScheduledTask'.
Detects a logon task or Run value that starts PowerShell with a network retrieval expression rather than a local administrative script. This rule specifically looks for modifications to registry run keys that include PowerShell or pwsh commands attempting to download content using methods like Invoke-WebRequest, DownloadString, DownloadFile, Net.WebClient, or curl.
Detects HKCU/HKLM Run key write whose registry_value_data points to an executable under AppData\Roaming, correlated with a FILE_CREATION of that executable on the same host within 5 minutes. Consistent with the TuglaInsaatci steganographic loader dropping a randomly-named copy of itself (e.g. dEprjIuLKcEd.exe) to AppData\Roaming and registering it for autorun.
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Detects a mismatched/synthetic iOS 18 User-Agent (Version/26.x) used by Kali365 to bypass detection. This specific User-Agent string is indicative of malicious activity as 'Version/26' does not natively exist on iOS 18.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
Detects Codex writing extremely large, encoded script blocks directly into HKCU registry values to achieve fileless reboot persistence.
This rule detects the installation of a LaunchAgent persistence mechanism on macOS. It specifically looks for the creation of a property list (.plist) file within the '~/Library/LaunchAgents/' directory, combined with the execution of the 'launchctl load' command, which is used to load and activate LaunchAgents. This technique is commonly used by malware, including infostealers, to establish persistence and survive system reboots.
Detects the creation of the WinSysCache registry run key designed to launch the RuntimeHost.exe component on startup, often associated with cryptojacking campaigns.
Hunts for the stealer explicitly utilizing xattr -c to strip the com.apple.quarantine extended attribute, bypassing Gatekeeper execution protections.
Correlates the successful establishment of a reverse proxy (ngrok/cloudflared) with an incoming interactive logon event originating from the local loopback, indicating the tunnel is actively being used for malicious purposes such as Terminal Server Phishing.
Detects the creation of a scheduled task by the Potemkin Loader using the 'schtasks.exe' utility. The rule specifically looks for command lines containing task creation flags combined with an executable path located within 'AppData' directories, which is a common persistence mechanism for this loader.
This rule detects the creation or modification of a scheduled task that uses 'schtasks', 'powershell', or 'pwsh' to launch an executable from user-writable locations such as Temp, AppData, Public, or ProgramData. The command line specifically looks for references to 'adobe', 'acrobat', or 'onedrive' in conjunction with these user-writable paths, indicating potential abuse of legitimate software for persistence or execution of malicious code.
Detects the use of 'net.exe' to create or modify user accounts, specifically looking for commands that include 'user', 'admin', and '/add'. This could indicate an adversary establishing persistence or escalating privileges by creating new administrative accounts.
This rule detects suspicious process creation events where a process is spawned from common user-writable directories (AppData\Roaming, AppData\Local\Temp, Desktop) and subsequently allocates memory with characteristics often associated with code injection or execution (VirtualAlloc, NtAllocateVirtualMemory, PAGE_EXECUTE_READWRITE, 0x40). It filters out known legitimate Windows processes that might exhibit similar behavior.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
This rule detects various suspicious activities related to privilege escalation and access token manipulation. It identifies the enablement of sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege) by non-system processes, suspicious API calls for token impersonation/duplication (ImpersonateNamedPipeClient, DuplicateTokenEx) from non-privileged processes, and the creation of SYSTEM child processes by medium-integrity parent processes. These behaviors are often indicative of an attacker attempting to elevate privileges on a compromised system.
Detects the attacker utilizing SimpleHelp's elevated privileges to create or modify Windows services to ensure persistent remote access independent of the RMM.
Page 120 of 401