Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects attempts to load kernel drivers using command-line utilities such as infinstall.exe, devcon.exe, pnputil.exe, or sc.exe. The detection specifically looks for these commands being initiated by powershell.exe, cmd.exe, or ServertoolLauncher.exe, which could indicate malicious activity like ransomware attempting to establish persistence or evade defenses.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Detects attempts to bypass User Account Control (UAC) by either modifying the registry key associated with the ms-settings protocol handler or by executing the fodhelper.exe binary via cmd.exe. These techniques are commonly used by attackers to gain elevated privileges without triggering a UAC prompt.
Detects modifications or creations of registry values within common Windows auto-start locations, specifically the 'Run' and 'Winlogon' keys. These locations are frequently abused by adversaries to maintain persistence on a host. The rule excludes common, legitimate installer and administration processes to reduce noise.
Detects the creation of a scheduled task using schtasks.exe where the command line includes indicators of potential script execution or remote command execution (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or 'http'). This is a common pattern for persistence mechanisms involving staged payloads.
Detects attempts to bypass User Account Control (UAC) by either modifying the registry key associated with the ms-settings protocol handler or by executing the fodhelper.exe binary via cmd.exe. These techniques are commonly used by attackers to gain elevated privileges without triggering a UAC prompt.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
Detects the use of reg.exe to modify Windows Registry Run or RunOnce keys pointing to executable files located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, which is a common persistence technique.
Detects instances where common Office applications or web browsers initiate the execution of schtasks.exe to create or modify scheduled tasks. This behavior is a common indicator of persistence mechanisms being established by malicious documents or browser-based exploits, excluding processes signed by Microsoft.
Detects the use of reg.exe to modify Windows Registry Run or RunOnce keys pointing to executable files located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, which is a common persistence technique.
This rule detects the use of the Windows Service Control Manager (sc.exe) to create or start a service on a remote host, identified by the presence of UNC paths (\\) and service management commands (create, start) in the command line.
Detects the creation of named pipes with names frequently associated with common post-exploitation tools, such as Cobalt Strike. The rule filters out common browser processes and critical Windows system processes to reduce noise.
Detects suspicious activity related to the Print Spooler service (spoolsv.exe), specifically focusing on the spawning of known command-line interpreters (cmd.exe, powershell.exe, rundll32.exe) by spoolsv.exe, as well as the creation or modification of DLL files within the system print spool drivers directory by processes other than spoolsv.exe. This activity is often associated with privilege escalation and persistence techniques involving print spooler service abuse.
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
Detects the creation or modification of Windows scheduled tasks using Security Event IDs 4698 and 4702. This rule parses the event data to extract key task information such as task name, command, arguments, and the author of the task.
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
This rule detects successful additions or updates to service principal credentials or application certificates/secrets within Azure AD. This activity can indicate persistence establishment by an attacker who has compromised an account with sufficient permissions to manipulate application identities.
Identifies PowerShell utilizing ProcessHollowing.Execute to hijack MsBuild.exe.
Detects the creation or modification of registry keys in HKEY_CURRENT_USER\Run, targeting registry values related to remote access applications like AnyDesk, Splashtop, or Comms. The rule specifically looks for evidence that these entries are configured to execute Python interpreter executables (e.g., pythonw.exe or WPy64), which can indicate an attempt to maintain persistence using authorized software or masqueraded scripts.
Detects modifications to Active Directory user accounts by monitoring Security Event ID 4738. The rule filters out service accounts (those ending with '$') and ensures the target username is populated.
Page 127 of 401