Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects anomalous process execution and filesystem access patterns originating from Gitea Act Runner that indicate an attempted container-to-host escape. This includes the injection of dangerous container flags (e.g., --pid=host, --privileged, --cap-add=ALL) into workflow commands, the execution of nsenter, or direct access to the host's filesystem structures (e.g., /host or /proc/1/root).
This rule detects various stages of exploitation activity associated with the System Informer PHSVC (Process Hacker Service) proof-of-concept (PoC). It monitors for the loading of the PoC DLL via rundll32, the spawning of processes using the specific PoC marker string, unexpected elevated child processes spawned by SystemInformer.exe, and the creation of services or PoC artifacts that facilitate privilege escalation or persistence.
This rule detects suspicious activities associated with the exploitation of AnyDesk, specifically targeting COM printer impersonation for privilege escalation and subsequent persistence. It monitors for: 1) AnyDesk or AnyDesk-runtime spawning suspicious child processes (e.g., cmd, powershell, sc), 2) unauthorized processes accessing the 'adprinterpipe' named pipe used for privilege escalation, and 3) the creation of new Windows services originating from the AnyDesk process chain.
Detects the creation of files with filenames '.store' or '.host' (or any dot-prefixed file) within the Windows TEMP directory by specific processes (python.exe or chost.exe). This behavior is observed in certain npm-based Remote Access Trojans (RATs) to drop configuration and state files.
Detects exploitation of the SystemInformer phsvc service via ALPC port abuse and trusted-host bypass. The attack involves loading a malicious DLL into the Microsoft-signed rundll32.exe process to bypass trust checks, subsequently connecting to the '\BaseNamedObjects\SiSvcApiPort' to invoke privileged APIs for LPE.
Detects the Gitea Act Runner CI/CD tool executing Docker containers with dangerous security flags (such as --privileged, --pid=host, or --cap-add=ALL) or spawning nsenter to interact with host namespaces. This behavior indicates a potential attempt to escape the container boundary and gain unauthorized root-level access on the underlying CI/CD runner host.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Detects AMOS malware forking a child process, using setsid to detach from the Terminal session, and then killing the Terminal window via killall Terminal to evade parent-process tracking. This is a key behavioral indicator of the Atomic macOS Stealer delivered via ClickFix campaigns.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
Detects the execution of a JScript file by cscript.exe using a legacy NTFS 8.3 shortname format. This is a specific behavior observed in Gootloader's persistence mechanism, where a .LNK file in the Startup folder executes a second-stage script.
Detects when a legitimate application, specifically 'pdf24.exe', loads 'cryptbase.dll' from a non-standard directory. This behavior is indicative of DLL side-loading, a technique known to be used by the PDFSIDER malware to evade detection and potentially escalate privileges.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
Detects successful authentications where a Temporary Access Pass (TAP) was used as the primary authentication method. TAPs bypass standard password and MFA requirements, and their usage outside of expected scenarios (like onboarding or account recovery) could indicate an adversary bypassing authentication mechanisms.
This rule detects the sideloading of 'UnityPlayer.dll' by 'BrowserViewUtility.exe' in conjunction with network communication to a 'windows.net' domain. This activity is indicative of the 'Dragon Weave' campaign, specifically the 'RustCloak' malware, which uses DLL sideloading for execution and Azure cloud for C2.
This rule detects process execution where the command line arguments contain keywords commonly associated with memory corruption and exploitation (e.g., shellcode, buffer overflow, heap/stack manipulation). The rule further filters for small executable files (less than 100KB) to increase the likelihood of identifying malicious tools or stagers.
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
Detects the attacker leveraging a stolen session token to create or modify inbox rules that move finance or payroll related emails to the Archive or Trash folders, or delete them, as observed in Tycoon2FA phishing campaigns.
This rule detects the execution of specific command-line strings and DLL loading associated with Proof-of-Concept (PoC) exploits targeting the System Informer (formerly Process Hacker) kernel driver service (phsvc). These patterns indicate potential attempts to interact with or exploit the driver for unauthorized purposes, such as privilege escalation.
This rule detects a POST request to the MyBB administrative interface (specifically the user-users module) that contains parameters indicating an attempt to escalate a limited administrative user to a full administrator by assigning the 'usergroup=4' or 'gid=4' identifier, which corresponds to the default Administrator group in MyBB.
Page 122 of 401