Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects potential local privilege escalation attempts targeting the SystemInformer PhSvc service. The rule identifies suspicious child processes spawned from rundll32.exe (acting as a proxy) or other common binaries, where the process chain indicates an interaction with the SiSvcApiPort or the use of phsvc-related command-line arguments, potentially leading to unauthorized elevated process creation or service installation.
Detects evidence of a local privilege escalation attempt targeting the SystemInformer (formerly Process Hacker) phsvc service. The detection identifies the loading of a known proof-of-concept DLL into rundll32.exe, the creation of specific indicator files on disk, or rundll32.exe executing command-line payloads associated with the exploit.
Detects anomalous process execution patterns associated with the Gitea Act Runner that indicate attempts to break out of container isolation. This includes the use of sensitive Docker flags like --privileged, --pid=host, or --ipc=host, the mounting of the Docker daemon socket, or the execution of nsenter to gain access to the host namespace, which are indicative of container escape techniques.
This rule detects potential local privilege escalation attempts targeting the AnyDesk printer service. The rule monitors for unauthorized COM server registration (COM hijacking) and the subsequent spawning of suspicious child processes (e.g., cmd.exe, PowerShell) directly linked to the AnyDesk process tree. This behavior is indicative of exploiting the AnyDesk COM object printer impersonation vulnerability to gain NT AUTHORITY\SYSTEM privileges.
Detects local privilege escalation attempts targeting the SystemInformer (formerly Process Hacker) PHSVC service. Adversaries can abuse the SiSvcApiPort ALPC port by using rundll32.exe to load specific malicious payloads that call privileged service APIs, such as PhSvcCreateProcessIgnoreIfeoDebugger or PhSvcCreateService, effectively bypassing standard user restrictions.
Detects suspicious child processes spawned by AnyDesk.exe or AnyDesk-runtime.exe that may indicate local privilege escalation. This rule specifically targets the abuse of the adprinterpipe named pipe and CoUnmarshalInterface to impersonate SYSTEM-level AnyDesk processes, allowing for the execution of unauthorized child processes.
Detects potential privilege escalation within the MyBB Administrative Control Panel (ACP). The rule identifies POST requests to user management modules that set a user's group ID (gid) or usergroup to 4, which typically corresponds to the administrator group in MyBB. It verifies the escalation by correlating it with a prior session that lacked administrator privileges and identifying a subsequent login event.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new account or modifying an existing one to belong to the administrator group (gid=4). This is indicative of an attacker attempting to gain full administrative control by bypassing module-level access restrictions.
Detects exploitation of the SystemInformer PhSvc service by monitoring for rundll32.exe launching with command-line arguments indicative of loading a proof-of-concept DLL and attempting to communicate with the SiSvcApiPort ALPC port. This activity is associated with abusing privileged helper APIs to perform unauthorized SYSTEM-level process creation or service installation.
Detects the creation or modification of shortcut (.lnk) files within the Windows Startup folder by known archive utilities (e.g., WinRAR, 7-Zip). This behavior is highly suspicious as these tools are commonly leveraged by adversaries to drop malicious payloads or persistence mechanisms into the user's startup directory.
This rule detects potentially malicious activity involving the WinRAR utility. It monitors for WinRAR creating files in Windows Startup folders, dropping files in specific ProgramData subdirectories often associated with staging malicious payloads, and spawning suspicious child processes such as command shells, scripting engines, or HTML applications.
Detects WinRAR (winrar.exe) creating shortcut (.lnk) files within the Windows Startup directory or staging suspicious files within specific ProgramData directories. This behavior is indicative of potential persistence mechanisms or malicious staging of secondary payloads by WinRAR.
Detects a suspicious execution chain where a command prompt (cmd.exe) launched from a Startup LNK context initiates a hidden PowerShell process with Execution Policy bypass flags. This pattern is often associated with fileless malware execution, specifically linked to UAC-0226 activity, aiming to execute obfuscated PowerShell scripts by reading payloads from memory or staged files.
Detects the creation of files within Windows startup folders originating from a WinRAR process. This behavior is indicative of an adversary using WinRAR to extract or drop malicious persistence items, such as shortcuts (.lnk) or executables, into auto-start locations to maintain persistence across reboots.
This rule detects sophisticated PowerShell activity involving reflective code loading and suspicious process interaction. It identifies three distinct patterns: malicious script execution using Invoke-Expression (IEX) on files within ProgramData, PowerShell script blocks utilizing low-level NT APIs (such as NtAllocateVirtualMemory and NtCreateThreadEx) often associated with reflective injection, and suspicious cross-process remote thread creation by PowerShell processes.
This rule detects PowerShell script block execution (EventID 4104) that contains indicators of process injection and memory manipulation. It specifically monitors for the presence of native Windows APIs (such as NtAllocateVirtualMemory or NtCreateThreadEx), memory protection flags indicating executable/writable memory (like 0x40), and unsafe native method calls. A scoring mechanism is used to aggregate these indicators and flag suspicious scripts, commonly associated with fileless malware or offensive security tools.
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Detects the registration of a new authentication method (phone, authenticator app, passkey, or security key) in Azure Active Directory after a session exhibits unusual location or token behavior, indicated by a high or medium risk level, anonymous proxy usage, or unfamiliar features.
Detects the UAC-0226 WC3 PowerShell loader script which utilizes .NET reflection to resolve native NT APIs for the reflective injection of the GIFTEDCROOK payload into memory. The loader exhibits behavioral indicators such as file staging in ProgramData, sandbox evasion via sleep commands, and the definition of RWX memory permissions.
This rule detects a multi-stage execution chain indicative of malicious LNK files placed in startup folders. It tracks the sequence starting with explorer.exe spawning cmd.exe (with /min switch), followed by a child powershell.exe utilizing common evasion flags, and concluding with a grandchild powershell.exe executing suspicious commands such as encoded commands, IEX, or referencing the ProgramData directory, all within a 10-minute window.
Detects PowerShell scripts attempting to perform memory injection by utilizing native Windows API calls (e.g., NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) alongside memory manipulation patterns such as byte manipulation and the use of System.Runtime.InteropServices.Marshal.
Page 123 of 401