Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation or starting of a Windows service on a remote host using the Service Control Manager (sc.exe) utility. This is a common method for lateral movement and remote execution of malicious payloads.
Detects modifications to the 'LimitBlankPasswordUse' registry setting to '0'. This modification enables remote network logons for accounts with blank passwords, a technique abused by threat actors like DragonForce for persistence.
Detects the deployment of the Kazuar backdoor, initiated by the Gamaredon group's PteroPaste loader. The rule monitors for a suspicious file creation event where a PowerShell or rundll32 process writes a DLL to a user-writable directory (AppData/Local or AppData/Roaming), followed immediately by the creation of a scheduled task (using schtasks) designed to trigger the execution of the dropped DLL via system binaries such as regsvr32, rundll32, or mshta.
Detects the creation or modification of Windows Registry keys within the 'CurrentVersion\Run' path, a common technique used by adversaries to achieve persistence by ensuring arbitrary programs execute upon user logon.
Detects the creation or modification of Windows Registry keys within the 'CurrentVersion\Run' path, a common technique used by adversaries to achieve persistence by ensuring arbitrary programs execute upon user logon.
Detects the execution of the Windows runas command using the /savecred flag. This flag instructs Windows to save the supplied credentials locally, which can be abused by unauthorized users to elevate privileges or execute processes in the context of a saved account without providing a password again.
Detects the creation of files within the Windows Startup directory. Adversaries use this folder to achieve persistence by ensuring that malicious files or shortcuts are executed automatically when a user logs in.
Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.
Detects when a ScreenConnect installer or related process loads the 'vcredist_x64.dll' file from a temporary, downloads, or AppData folder. This behavior can indicate DLL side-loading, where a malicious DLL is placed in a location that a legitimate application will search before its intended, trusted location, potentially for privilege escalation or persistence.
Detects the creation or modification of Windows Registry Run keys, which are a common mechanism for achieving persistence by executing programs automatically upon user logon or system boot. The rule excludes common, legitimate software update or installation processes that frequently interact with these keys.
Detects cross-process access (such as memory read/write) by an unsigned process against sensitive system processes (e.g., lsass.exe, svchost.exe, explorer.exe). This activity is often a precursor to credential dumping, process hollowing, or other forms of process injection used by malicious actors to achieve persistence or privilege escalation.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects the creation or modification of Windows Registry Run keys, which are a common mechanism for achieving persistence by executing programs automatically upon user logon or system boot. The rule excludes common, legitimate software update or installation processes that frequently interact with these keys.
Detects cross-process access (such as memory read/write) by an unsigned process against sensitive system processes (e.g., lsass.exe, svchost.exe, explorer.exe). This activity is often a precursor to credential dumping, process hollowing, or other forms of process injection used by malicious actors to achieve persistence or privilege escalation.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects Vidar Stealer performing classic APC injection into a browser process (Chrome/Edge/Brave) using CreateRemoteThread with NtTestAlert as the thread start address and NtQueueApcThread to queue CryptUnprotectMemory for in-memory ABE v20_master_key decryption.
Detects Entra ID guest (B2B) users performing a sign-in from a previously unseen IP address or country (observed over the last 30 days), followed within a 4-hour window by sensitive file operations in SharePoint, OneDrive, or Teams (e.g., file downloads, exports, or sensitivity label changes). This pattern is indicative of potential account takeover or unauthorized access to sensitive corporate data.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
This rule identifies potential account compromise by detecting successful logins to at least two different SaaS applications monitored by Microsoft Cloud App Security (MCAS) within a 2-hour window, originating from geolocations separated by more than 500 kilometers. This behavior is indicative of credential sharing or account hijacking where an adversary accesses multiple cloud services rapidly from geographically distant locations.
Detects the creation of a mutex with a specific pattern used by the MonsterV2 malware, a sophisticated RAT, loader, and stealer.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
Page 125 of 401