Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects modifications to Windows Registry 'Run' or 'RunOnce' keys where the registered value points to suspicious locations such as Temp, AppData, or Downloads directories, which is a common technique for establishing persistence.
Campaign converting compromised FortiGate firewalls into credential stealers
This rule detects potential brute force authentication attempts via LDAP occurring shortly after a specific DLL (ending in 'ode.dll') is loaded on a system. This behavior may indicate an adversary is using a malicious or secondary module to facilitate credential brute forcing or unauthorized authentication attempts.
Detects non-interactive sign-ins to Microsoft 365 using the OAuth Resource Owner Password Credentials (ROPC) flow via the Azure CLI. This legacy authentication method enables attackers to bypass multi-factor authentication (MFA) by submitting credentials directly to the authentication endpoint, a technique observed in password spraying campaigns.
Detects PamStealer's embedded helper binary dropped to /private/tmp/System Settings and used to establish legacy login item persistence via osascript System Events
Detects file creation, modification, or renaming events within sensitive macOS Application Support directories that mimic core system components such as Finder or Software Update. This behavior is indicative of potential masquerading or persistence techniques where an attacker replaces legitimate application resources with malicious ones.
Detects the Finder application on macOS loading authentication modules (libpam.dylib) from within the 'Application Support' directory. The rule further correlates this by checking if common system utility tools (dscl, security, osascript) were initiated by the same Finder process path, flagging cases where legitimate system activity is absent, which may indicate potential dylib hijacking or suspicious process behavior.
This rule monitors for the loading of a specific driver file, 'pcdhost.sys', followed by a process termination event within a five-minute window. This behavior is indicative of a 'Bring Your Own Vulnerable Driver' (BYOVD) attack pattern, where an adversary loads a vulnerable driver to gain kernel-level access or elevate privileges, often followed by the cleanup or termination of the process that facilitated the loading.
Detects the creation or modification of Windows Registry Run/RunOnce keys that point to executable files located in suspicious directories, specifically 'AppData' or 'Temp'. This behavior is a common persistence technique used by malware and adversaries to ensure malicious binaries execute upon user logon.
Detects APC-based sleep encryption patterns commonly used by malware loaders like FOLIAGE and AceLdr. The rule identifies suspicious sequences of NtQueueApcThread and NtTestAlert calls targeting the same thread, which are used to automate the in-memory encryption/decryption cycle between C2 callbacks while evading detection by maintaining a quiet user-mode memory profile.
Detects the creation or modification of a registry run key in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run with the name 'MicrosoftUpdate' and data containing 'system.bat'. This is a common technique used by adversaries to establish persistence, ensuring their malicious code executes upon user login.
Detects the creation of a scheduled task via schtasks.exe identified by the specific command-line string associated with 'CrysomeLoader', configured to execute every 5 minutes.
Detects high-integrity or system-level processes launched by specific shellcode-like filenames or processes containing 'ICMLuaUtil' in the command line. This technique is often indicative of a UAC bypass attempt, where malicious actors attempt to elevate privileges by abusing the ICMLuaUtil COM interface, while excluding the standard Windows consent dialog processes.
Detects remote thread creation from CACTUSTORCH as described in references.
Detects an infostealer-style remote injection chain where a non-browser process allocates memory, writes a DLL path, and creates a remote thread pointing at kernel32!LoadLibraryW inside chrome.exe, msedge.exe, brave.exe, or firefox.exe. This suspend-inject-resume pattern is used by WEES Stealer to load its payload DLL into a browser process before intercepting App-Bound key material.
Detects potential local privilege escalation attempts leveraging the AnyDesk printer named pipe (adprinterpipe). The rule monitors for the creation of the adprinterpipe, the spawning of processes with SYSTEM privileges from an AnyDesk parent, and the loading of suspicious DLLs by AnyDesk, which are indicative of an exploit leveraging insecure COM unmarshaling callbacks.
Detects DLL search order hijacking of legitimate Windows binaries consent.exe or icardagt.exe. The rule triggers when these binaries are executed from non-standard, user-writable directories (e.g., %TEMP%, %APPDATA%), which is a common technique used by the BumbleBee malware loader to sideload a malicious msimg32.dll.
This rule detects processes that perform both memory allocation (VirtualAlloc) and cryptographic random number generation (BCryptGenRandom) within a short timeframe. This combination is highly characteristic of reflective loading or stage-based process injection, where an adversary allocates memory for shellcode and generates keys or seeds for encrypted payloads, often used to evade signature-based detection.
This rule detects DLL side-loading attempts by identifying signed processes that load unsigned or invalidly signed DLLs from the same directory as the initiating process, specifically excluding standard system directories (System32, SysWOW64, WinSxS) to reduce noise. This behavior is a common technique used by attackers to execute malicious code under the context of a trusted, legitimate application.
Detects the usage of the 'docker cp' command containing directory traversal sequences ('../') in the destination argument. This behavior is associated with a known container escape technique where an attacker can overwrite files on the host filesystem by escaping the container's designated storage path.
Detects unauthorized access attempts to MinIO object storage using the default 'minioadmin' credentials. The rule specifically flags attempts to access sensitive files like 'terraform-state' or 'credentials.json' via HTTP GET requests.
Page 22 of 401