Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
Detects attempts to perform a container escape via the docker cp command by abusing path traversal vulnerabilities or suspicious file write operations performed by the Docker daemon to the host filesystem outside of standard container paths, often associated with symbolic link extraction exploits.
Detects local privilege escalation attempts targeting the SystemInformer service (phsvc.exe) IPC mechanism. The rule identifies suspicious process activity, including the side-loading of a PoC DLL into rundll32.exe, the spawning of child processes from the SystemInformer service context, and the presence of PoC artifacts in system paths, which are used to gain SYSTEM-level execution.
Detects LCRYX ransomware establishing persistence by modifying the Winlogon Shell registry key and creating multiple VBScript-based entries in Windows Run keys. The rule monitors for registry modifications targeting known persistence locations with suspicious scripts as values.
Detects suspicious Registry modifications made by scripting hosts (wscript.exe, cscript.exe) often associated with malware persistence. This includes unauthorized modifications to Winlogon shell keys, addition of known malicious script names to Run keys, installation of scripts into startup paths, and Image File Execution Options (IFEO) debugger hijacking for cmd.exe.
This rule detects potential persistence mechanisms by monitoring modifications to specific Windows registry keys. It looks for the creation or modification of 'Image File Execution Options' (IFEO) debugger keys, which can be used to hijack process execution, and specific 'Run' keys that could be used for unauthorized startup execution. The rule focuses on these activities when initiated by script interpreters like wscript.exe or cscript.exe.
Detects Hannibal Stealer-related process injection patterns involving the use of legitimate Windows binaries (sppextcomobj.exe, slui.exe) spawned by rundll32.exe, or specific child-process relationships, correlated with directory paths associated with CefSharp.BrowsersSubprocess or SCef.WindowsAdapter, which are indicative of malware staging.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
Detects activity associated with N-able Take Control and AnyDesk remote monitoring and management (RMM) tools, including silent execution, suspicious LNK file creation, and persistence via registry modifications.
Detects unauthorized modifications to the Image File Execution Options (IFEO) registry keys for 'cmd.exe'. The rule specifically looks for the 'Debugger' value being set to script-based interpreters (e.g., .vbs, .js, wscript, cscript), a technique known to be used by LCRYX ransomware to intercept security tool execution and establish persistence.
This rule detects unauthorized modifications to common Windows persistence registry keys, including 'Run' keys, the 'Winlogon Shell' value, and 'Image File Execution Options' (IFEO) debugger values. These modifications are commonly used by adversaries to establish persistence or intercept process execution.
Detects Self-Service Password Reset (SSPR) activity followed by the deletion of authentication methods within a 1-hour window. This sequence of events can indicate an attacker attempting to maintain access or bypass multi-factor authentication after gaining initial access to an account, potentially executed by threat groups like Storm-2949.
This rule correlates commands indicative of privilege escalation (checking local administrator groups or user privileges) with subsequent manipulation of Quality of Service (QoS) policies via WMI. This sequence of events suggests an attacker gaining elevated privileges and then attempting to throttle network traffic, potentially to hinder EDR/security tool communication or data exfiltration.
Identifies logins from geographically distant locations occurring faster than physically possible, highlighting proxy infrastructure. This KQL query analyzes Google Workspace login success events, grouping them by account and a 10-minute time window. It then filters for instances where an account has successfully logged in from two or more distinct locations within that short timeframe, indicating potential impossible travel.
GraphWorm Persists through a Run Key
Cortex XDR
Detects the creation or modification of a Windows Registry Run key that points to an executable with names associated with GraphWorm or C2OverOneDrive malware, or an unusual OneDrive-themed binary located outside of legitimate OneDrive client paths. This rule specifically looks for registry events where the key name contains 'CurrentVersion\Run' and the data contains 'C2OverOneDrive', 'GraphWorm', 'OneDrive.*AppData', or 'config.dat'.
Detects the execution of a 64-character hex-named executable using the 'i=' parameter for potential process injection or tracking, indicative of Makop Ransomware activity.
Identifies the payload establishing persistence on macOS by utilizing launchctl to load the fake ChromeUpdater plist job.
Correlates processes executing from the Public directory utilizing VirtualAllocEx to allocate PAGE_EXECUTE_READWRITE memory, a precursor to process hollowing.
This rule detects the execution of 'GodPotato-NET4.exe', a known tool used to escalate privileges to SYSTEM on Windows systems. Detection is based on the file name or its presence in the process command line.
Detects malware modifying memory protections to hook AccessCheckByType to force access success.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Page 134 of 401