Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the presence of 'access_token' and 'step' strings in conjunction with 'POST' and 'application/json' within network traffic or files, indicating potential C2 communication or data exfiltration related to the Remus malware distribution ecosystem.
This rule detects the loading of Aspose.Email DLLs from suspicious user-writable or temporary directories. This behavior is indicative of an attacker potentially using a legitimate library for malicious purposes, possibly to evade detection or to collect information, rather than an approved mail application loading it from its intended location.
This rule detects persistence attempts using Image File Execution Options (IFEO) debugger redirection for 'vds.exe'. Specifically, it looks for registry modifications where the 'debugger' value for 'vds.exe' points to an executable located within the 'Windows\Fonts' directory. This technique is often used by adversaries to maintain access or elevate privileges by hijacking legitimate application execution.
Detects the VSPMsg print processor path and DLL name, which is associated with the SprySocks malware for persistence on Windows systems. The rule looks for specific strings related to the DLL name, print processor path, and common installation directories used by this malware.
Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.
Identifies the creation or modification of the 'NvmProtocal' registry value within the CurrentVersion\Run key. This mechanism is used by the cross-platform infostealer associated with the compromised Mastra npm packages to maintain persistence across system reboots.
Detects the creation of scheduled tasks using specific Mozilla-related naming patterns ('\Mozilla\UpdateTask' or '\Mozilla\ElevateTask') that execute with SYSTEM privileges, a behavior associated with Payouts King ransomware persistence mechanisms.
Detects the creation of suspicious scheduled tasks used by the StrikeShark campaign for persistence. These tasks are named with a prefix mimicking OneDrive updates ('OneDrive Standalone Update Task-S-1-') and are configured to execute SystemSettings.exe from specific AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates process execution logs and scheduled task creation events to identify the dropper activity.
Identifies the creation of a scheduled task using 'schtasks.exe' where the initiating process is a Bomgar executable (bomgar-rep.exe or bomgar-scc.exe). This behavior is indicative of an attacker establishing persistence after exploiting a Bomgar vulnerability.
Detects the creation of a Windows Service pointing to a suspected Komari agent binary in a non-standard directory (Public, ProgramData, or Temp) to survive reboots. This rule specifically looks for 'sc.exe' being used with the 'create' command and a 'binPath' argument that includes one of the specified directories and ends with '.exe'.
Detects the creation or modification of a Registry Run key to establish persistence using PowerShell with specific obfuscation techniques. The rule looks for PowerShell commands that include '-NoProfile', '-ExecutionPolicy Bypass', '-WindowStyle Hidden', and '-File', and also references a temporary directory ('AppData\\Local\\Temp'). This combination is often used by adversaries to execute malicious scripts discreetly upon user logon.
This rule detects potential DLL sideloading by identifying signed executables that load unsigned DLLs from user-writable directories, such as Temp, AppData, Downloads, or Documents. It excludes loads from standard, protected Windows directories to reduce noise.
Detects WMI persistence mechanisms by monitoring for suspicious child process spawning from WMI host processes (scrcons.exe, wbemcons.exe), unauthorized loading of MOF files via mofcomp.exe, and execution of common living-off-the-land binaries directly by the WMI provider host (wmiprvse.exe).
This rule detects potential persistence attempts by monitoring for the execution of 'schtasks.exe' with the '/create' flag or the loading of 'taskschd.dll' by suspicious parent processes. These parents include script interpreters (e.g., powershell, wscript), Microsoft Office applications, and various living-off-the-land binaries or web-related utilities, which are commonly abused by adversaries to establish persistence via the Windows Task Scheduler.
Detects the creation of suspicious named pipes by low-privilege processes, which is a technique used by local privilege escalation tools (like PrintSpoofer, RoguePotato, and GodPotato) to intercept and impersonate high-privilege (SYSTEM) tokens.
Detects the creation or modification of a Registry Run key that executes PowerShell with specific parameters indicating a hidden window, no profile, bypass execution policy, and referencing a script in the AppData\Local\Temp directory. This is a common technique used by adversaries for persistence and to evade detection.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
Detects when a guest user (identified by '#EXT#' in their UPN) is assigned a sensitive role like 'Agent ID Administrator' or 'AgentAdministrator' in Entra ID. It also detects when any user, including guest users, performs modifications related to 'Agent' blueprints. This rule aims to identify potential privilege escalation or unauthorized administrative actions by external users within an Azure Active Directory environment.
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
This rule detects the COM activation of 'Windows.Internal.InstallService.Control.InstallServiceControl' by non-SYSTEM processes, which can be abused to invoke 'CreateInstallServiceWork' for UNC-based DLL coercion. It looks for specific strings in process command lines and additional fields in device events, as well as suspicious loading of 'combase.dll' by non-system processes.
Detects the creation of a specific scheduled task named 'WindowsSecurityUpdate' using 'schtasks.exe' in conjunction with network communication to 'azurewebsites.net'. This activity is indicative of the MiniUpdate malware, associated with the Iranian APT group 'Screening Serpens', attempting to establish persistent access.
Page 140 of 401