Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Identifies the threat actor modifying Azure AD Cross-Tenant Access Policies to allow B2B collaboration with external attacker-controlled tenants.
Detects the creation of scheduled tasks that masquerade as legitimate update processes (e.g., Microsoft Edge, Google Updater) using elevated privileges (/rl highest) and triggering on system logon (/sc onlogon). The rule specifically flags tasks associated with suspicious paths or binary names like VMWare or PerfWatson to identify potential persistence or execution mechanisms.
Detects the creation or opening of a named event (SyncedEventCreate, SyncedEventOpen, CreateEvent, OpenEvent) on Windows systems using the specific, potentially malicious, object name 'ShitSetupOn26126k'. This pattern often indicates inter-process communication associated with specific malware or unauthorized tool execution.
Detects the presence of Windows Media Player or Mixed Reality process executions in conjunction with the creation of a specifically named DLL (nvdaHelperRemote.dll) within the Windows Media Player directory, which is a common indicator of DLL side-loading or hijacking techniques targeting these applications.
Detects cross-process activity originating from the 'nvdaHelperRemote.dll' library targeting 'svchost.exe'. This pattern is indicative of potential process injection where a malicious actor or suspicious process attempts to inject code or manipulate the memory space of a core Windows system process via this specific helper library.
Detects potential DLL sideloading attempts where a malicious 'Mixed Reality.exe' loads a 'nvdaHelperRemote.dll' from the Windows Media Player directory, or the creation of these suspicious files by unrecognized processes, potentially linked to a dropper file 'COU_ITR-1_to_4_AY2026-27.exe'.
This rule detects potential container escape attempts utilizing Linux system calls such as 'unshare' or 'clone' with flags indicative of namespace manipulation (CLONE_NEWUSER, CLONE_NEWNET). It also detects the execution of suspected malicious binaries or traffic manipulation tools associated with 'packet_edit_meme' or 'act_pedit' activities, which are common in Linux-based exploitation scenarios.
Detects the use of specific Linux utilities often associated with container escape or privilege escalation exploits. This includes the use of 'aa-exec' with restricted profiles, 'unshare' for namespace manipulation, and specific command-line patterns targeting vulnerability-related exploitation scripts.
Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.
Detects the use of 'unshare' to create new kernel namespaces or 'tc' (Traffic Control) with specific parameters (pedit) to manipulate packet headers. These tools are often leveraged by adversaries to perform privilege escalation or network redirection/manipulation within a Linux environment.
Detects the script escalating privileges using the stolen password via sudo to strip quarantine extended attributes from the payload.
Detects unsigned or non-Microsoft signed executables running from the Windows Media Player installation directory. This behavior is indicative of masquerading techniques used by attackers, such as the Operation DragonReturn campaign, to hide malicious services or components within trusted system directories.
Detects attempts by potentially malicious processes to inject code into svchost.exe. The rule monitors Sysmon Event ID 10 (ProcessAccess) for specific granted access masks (0x1fffff, 0x1f0fff, 0x143a) commonly used for virtual memory manipulation, while excluding trusted Windows system processes.
Detects execution of Linux Traffic Control (tc) commands, module loading, or specific strings related to the exploitation of CVE-2026-46331, involving the act_pedit kernel component. These activities are associated with a potential kernel-level copy-on-write (COW) page cache corruption vulnerability that could be used for privilege escalation.
Detects the execution of the Linux 'tc' (traffic control) utility with 'act_pedit' by an unprivileged (non-root) user. This pattern is associated with attempts to leverage the CVE-2026-46331 vulnerability, which involves a Copy-on-Write (COW) kernel exploit triggered through malicious netlink operations in the traffic control subsystem to achieve privilege escalation.
Detects execution of known Proof-of-Concept binaries (pedit_cow_demo or packet_edit_meme) followed by /bin/su spawning /bin/sh, which indicates successful exploitation of the pedit COW vulnerability resulting in shellcode execution with root privileges.
Detects DcRAT malware injecting malicious code into the legitimate Windows system process svchost.exe. The rule monitors for a suspicious process launching and accessing svchost.exe, coupled with the presence of specific API calls associated with process injection techniques like memory allocation, payload writing, and remote thread execution within the command line context.
Identifies the creation of a LaunchAgent property list masquerading as 'com.google.keystone.agent.plist'. This behavior is associated with the ClickFix campaign, which uses fake macOS utilities to deliver infostealers.
Detects the creation of the .agent shell wrapper file designed to supervise and restart the .mainhelper backdoor process.
Detects svchost.exe (hosting InstallService) loading InstallServicePlugin.dll from a UNC path, which is indicative of the UnCanny Local Privilege Escalation (LPE) technique. This behavior is suspicious as legitimate svchost processes typically load DLLs from local system paths, not network shares.
Detects device registration attempts mapping a refresh token to the Device Registration Service (ms-drs) for persistence. This activity can be indicative of an adversary attempting to maintain access or bypass conditional access policies by registering a new device.
Page 138 of 401