Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
Detects the loading of known vulnerable or unsigned drivers, specifically targeting Huawei-signed driver variants, which have been leveraged by DragonForce for Bring Your Own Vulnerable Driver (BYOVD) defense evasion. The rule identifies driver loads where the file name matches known vulnerable Huawei drivers or where the driver is loaded by an unusual process and not from a standard system directory, and is also untrusted.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Detects the use of command-line arguments associated with Windows token impersonation techniques (e.g., 'SeImpersonate', 'ImpersonateLoggedOnUser') initiated by common command-line interpreters (powershell.exe, cmd.exe, wmic.exe). This activity is often indicative of an adversary attempting to elevate privileges by stealing or manipulating access tokens.
Detects an SSPR (Self-Service Password Reset) event immediately followed by the registration of a new Microsoft Authenticator method for the same user. This sequence of events can indicate an attacker has compromised an identity, performed a password reset, and is attempting to establish a new MFA method for persistent access.
Detects the MYRA RAT using memfd_create and fexecve to execute a Rust payload entirely in memory without writing an executable to disk, as observed in the Operation Friday Harvest npm supply chain campaign. The rule looks for process events where the action type indicates process creation, memory allocation, or process access, or where the FolderPath starts with '/proc/' and contains '/fd/'. It specifically targets initiating processes named 'node' or 'npm' or those with command lines associated with npm post-installation scripts. Further filtering is applied to FolderPaths matching the '/proc/\d+/fd/\d+' regex or ProcessCommandLines containing 'memfd_create' or 'fexecve', or FolderPaths containing 'memfd'.
Detects DbgView.exe, DbgView64.exe, or VirtualBox.exe processes making unexpected outbound network connections to public IP addresses. This behavior is associated with Backdoor.Turn, which is known to inject into these trusted processes via DLL sideloading to communicate with C2 servers, potentially routing traffic through Microsoft Teams TURN relays.
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
This rule detects the execution of a social engineered installer followed by the spawning of hollowed binaries. It correlates the execution of executables with names matching common AI tools or generic setup files (e.g., deepseek, gpt, kimi, fraudgpt, ProFluxeFlowAi, setup) with the subsequent execution of .NET utility tools (InstallUtil.exe, RegAsm.exe, MSBuild.exe) that are often abused for process hollowing, especially when their command line does not contain a hyphen, indicating non-standard usage.
Detects broad hollowing logic involving injected Microsoft utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, aspnet_compiler.exe, MSBuild.exe) communicating over non-standard web command and control ports (8443, 5443, 8041). This rule specifically excludes common initiating processes like cmd.exe, powershell.exe, explorer.exe, and svchost.exe to reduce noise.
This rule detects a specific DLL sideloading sequence associated with the 'Screening Serpens' threat actor. It correlates the loading of 'uevmonitor.dll' with the subsequent dropping of 'unbcl.dll' by the same initiating process within a 5-minute window. This behavior is indicative of the MiniJunk V2 malware's execution chain, where 'uevmonitor.dll' is likely the legitimate application being hijacked to load the malicious 'unbcl.dll'.
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
Detects silent MSI installations that drop specific DLLs (autorun.dll or vcredist_x64.dll) and subsequently spawn a ScreenConnect client service within a 5-minute window. This behavior is indicative of potential persistence or remote access tool deployment.
Identifies the specific Start-Process -Verb RunAs pattern invoked by the underlying dropping mechanism, specifically looking for PowerShell executing this command in conjunction with a cmd.exe process running 'vvvv.cmd'. This pattern is associated with the UnregStealer malware for privilege escalation.
This rule detects attempts to load kernel drivers using command-line utilities such as infinstall.exe, devcon.exe, pnputil.exe, or sc.exe. The detection specifically looks for these commands being initiated by powershell.exe, cmd.exe, or ServertoolLauncher.exe, which could indicate malicious activity like ransomware attempting to establish persistence or evade defenses.
Detects a process launching from the USOShared or firefx public folders and subsequently modifying the registry. This activity is associated with the Operation XENOFISCAL campaign, which has been observed deploying the Xenorat RAT.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Detects the execution of known Windows privilege escalation tools commonly used in post-exploitation scenarios, such as JuicyPotato, PrintSpoofer, and other 'Potato' variants, by monitoring for process file names associated with these utilities.
Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.
This rule detects the execution of 'eventviewer.exe' by scripting engines such as 'wscript.exe', 'cscript.exe', or 'vbscript.exe'. This behavior is indicative of a User Account Control (UAC) bypass technique where 'eventviewer.exe' is abused to elevate privileges without user interaction.
Detects the creation of a new LNK file in a user's Startup folder that references PowerShell, mshta, or rundll32, indicating a potential persistence mechanism. This rule specifically looks for file creation events where the target file is a .lnk file within the 'Start Menu\Programs\Startup' path and the command line of the creating process contains 'powershell', 'pwsh', 'cmd', 'wscript', or 'mshta'.
Page 136 of 401