Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects the loading of a kernel driver named 'g11.sys', which is associated with the PoisonX campaign, a technique typically used for kernel-level persistence or exploitation.
Detects the use of the Windows 'net use' utility to mount a C$ administrative share using explicit user credentials. This behavior is commonly associated with lateral movement techniques where an adversary attempts to connect to a remote system share to gain access, transfer files, or execute binaries.
Detects successful authentication events in Azure SigninLogs that utilize the Device Code OAuth flow. Attackers may leverage this flow in phishing campaigns or to bypass MFA by tricking users into authorizing malicious devices, which can lead to subsequent token theft.
Detects potential token impersonation activities where 'DuplicateTokenEx' or 'ImpersonateLoggedOnUser' functions are used in conjunction with 'explorer.exe'. This pattern is often used by adversaries to perform unauthorized privilege escalation or lateral movement by impersonating the security context of a logged-on user.
Detects failed authentication attempts using the BAV2ROPC user agent (Azure CLI / legacy OAuth2 ROPC token requests) in Microsoft 365 Unified Audit Logs. BAV2ROPC bypasses MFA by authenticating directly to the /token endpoint. Error codes 50053 (account lockout), 50126 (invalid credentials), and 50034 (user not found) are characteristic of password spraying activity. Observed in the LSHIY LLC password spray campaign (June 2026).
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
This rule detects the creation of a Windows service named 'SecurityHealthIron' using the sc.exe utility or direct service creation calls. This specific naming convention is often associated with suspicious or potentially malicious activity attempting to masquerade as a legitimate Windows Security Health service.
Detects the dropping of a suspicious DLL file ('abe_decrypt.dll') in a temporary directory, followed by the termination and relaunch of a browser process (Chrome, Edge, or Brave), and the subsequent loading of the same DLL into the browser process, which is highly indicative of browser process injection and DLL hijacking activity.
Detects the modification of the Image File Execution Options (IFEO) registry key for the Microsoft Defender service executable (MsMpEng.exe) by setting a 'Debugger' value. This technique is often used to impair security defenses by redirecting or preventing the execution of the Antivirus engine.
Detects a Node.js process termination followed by a quick respawn of a new Node.js process by the same parent process. This pattern suggests a watchdog persistence mechanism where the parent process monitors the child, automatically restarting it if it is terminated, consistent with behaviors observed in malware such as Void Dokkaebi.
Detects the creation of a Windows scheduled task named 'WindowsHelper' that is configured to execute a 'run.vbs' script via wscript.exe every five minutes. This behavior is associated with the persistence mechanism used by the Armored Likho BusySnake Stealer malware.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Detects module loads of suspected malicious DLLs (associated with HijackLoader/CastleLoader or ClickFix campaigns) by signed host processes from non-standard user-writable directories like ProgramData. It also monitors for the execution of known sideloading host binaries (e.g., ssh-add.exe) from suspicious staging directories.
This rule detects the creation of or connection to the hardcoded 'RoguePlanet' named pipe, which is utilized as an IPC synchronization channel by the Nightmare Eclipse Defender exploit. The rule monitors for both pipe creation and connection events via Sysmon and Defender for Endpoint (DeviceEvents) telemetry, flagging potential malicious usage or interactions with security processes.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Detects the sequence of API calls and process state changes indicative of process hollowing targeting a suspended svchost.exe process. The rule monitors for the creation of a suspended svchost.exe process followed by memory operations such as unmapping, allocating, and writing to the target process memory, culminating in thread context modification and resumption, a behavior consistent with malicious process injection techniques.
This rule detects successful Azure AD sign-in events (ResultType 0) that occur following a series of repeated failed sign-in attempts (ResultType 50126) from the same user account. The activity is specifically scoped to the LSHIY IPv6 address range and utilizes Azure CLI or similar mobile/desktop client applications, which is a strong indicator of an automated password spraying or credential stuffing attack followed by a successful compromise.
Detects the creation of a .plist file in a user LaunchAgents directory within 300 seconds of the process loading the ServiceManagement framework. This pattern is often used by macOS applications to establish persistence or perform background tasks, but can be indicative of malicious activity if associated with unauthorized or masquerading binaries.
This rule detects potentially malicious process injection activities where an unsigned or improperly signed process attempts to perform actions like creating a remote thread or opening a process against critical system processes (explorer.exe, svchost.exe), followed closely by the loading of an unsigned module by those same system processes.
This rule detects when a user containing the name "admin" in the username fails to log in via SSH.
This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity.
However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity.
However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
Page 20 of 401