Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of scheduled tasks from XML files in 'C:\Users\Public\Documents\' by 'schtasks.exe' and subsequent execution of JavaScript payloads via 'wscript.exe' or 'cscript.exe' from the same public documents directory. This activity is attributed to the CryptoBandits threat group.
Detects modifications to Windows Registry keys associated with Image File Execution Options (IFEO) or Silent Process Exit, which are techniques commonly abused by adversaries to hijack execution flow for persistence or privilege escalation. The rule monitors for the creation or modification of 'Debugger', 'GlobalFlag', 'MonitorProcess', or 'ReportingMode' values, excluding known legitimate debuggers.
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
Detects modifications to Windows Registry keys associated with Image File Execution Options (IFEO) or Silent Process Exit, which are techniques commonly abused by adversaries to hijack execution flow for persistence or privilege escalation. The rule monitors for the creation or modification of 'Debugger', 'GlobalFlag', 'MonitorProcess', or 'ReportingMode' values, excluding known legitimate debuggers.
Detects various activities associated with Operation Poisson Havoc Demon, including the loading of 'senti.dll' (a shellcode carrier), PowerShell execution spawned from 'explorer.exe' (indicating potential shellcode injection), execution of 'RevS.ps1' (a PowerShell reverse shell), and the presence of other suspicious files like 'PhantomBackdoor' and 'TencShell'.
This rule detects the creation of scheduled tasks using 'schtasks.exe' or Windows Security Event ID 4698, specifically looking for tasks configured to run with 'HighestAvailable' privileges or tasks that execute suspicious script files (sys.vbs, Thal.exe, wscript.exe, cscript.exe). This behavior can indicate an adversary establishing persistence or escalating privileges.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Detects modifications or publication of Azure Automation runbooks by users or service principals other than known, pre-approved automation service principals. This activity may indicate an unauthorized user or compromised service principal attempting to inject malicious code into automation workflows.
Matches the hardcoded VAPID Public Key string used by the extension to bypass browser sandboxes and wake the service worker, indicative of the SNOWBELT malware's command and control mechanism.
Detects Device Code Flow authentication originating from abused Railway.com infrastructure, widely abused by Kali365.
Detects unusual DLL loads associated with the VirtualBox DbgView64.exe process, potentially indicating the DLL sideloading technique used to inject the Backdoor.Turn RAT.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
This rule detects the creation of .lnk files in common suspicious directories (such as startup folders, Temp, or Downloads) followed by the execution of common scripting or command interpreters (powershell.exe, mshta.exe, wscript.exe, cmd.exe) with long command lines within a 10-minute window. This behavior is often indicative of an adversary attempting to achieve persistence or execute malicious payloads via user interaction.
Detects critical Windows system processes (svchost.exe, lsass.exe, csrss.exe, wininit.exe, winlogon.exe, spoolsv.exe) that are either spawned by unexpected parent processes or reside in non-standard directories. This behavior is indicative of potential masquerading, process injection, or malicious persistence attempts.
This rule detects two common persistence techniques: the modification of Windows Registry Run keys with paths referencing temporary or application data directories, and the creation of autorun.inf files on removable or non-system drives to facilitate potential code execution upon media insertion.
Detects the creation of WMI event subscriptions that utilize CommandLineEventConsumer or ActiveScriptEventConsumer to execute common living-off-the-land binaries like powershell.exe, cmd.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is a common technique used for establishing persistence or executing malicious payloads via WMI event mechanisms.
This rule detects potential persistence via Registry Run keys (T1547.001) where a value is added pointing to a file in an AppData or Temp directory, followed by a successful outbound network connection from a process located in those same directories. This behavior is indicative of malware or an adversary establishing persistence and immediately reaching out to a command-and-control (C2) server.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
Detects PowerShell running Profile.ps1 decrypting the payload into RuntimeBroker_update.exe. This rule specifically looks for the execution of 'powershell.exe' with 'Profile.ps1' in its command line, followed by the creation of 'RuntimeBroker_update.exe' by that PowerShell process.
Detects generic instances of scripting languages (Python/PowerShell) leveraging anomalous named pipes (e.g., PipePipe!, postex) to inject or execute shellcode directly in memory.
Page 129 of 401