Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.
Detects modifications to the Image File Execution Options (IFEO) registry keys for critical Windows accessibility binaries such as osk.exe, utilman.exe, sethc.exe, magnify.exe, and narrator.exe. This technique is commonly used by adversaries to establish persistence or facilitate unauthenticated privilege escalation by replacing these tools with malicious executables (e.g., cmd.exe) that execute when triggered from the Windows login screen.
Detects anomalous process behavior potentially related to the RoguePlanet exploit or Poseidon-like thread I/O saturation techniques. This rule identifies processes performing high-frequency file creation in the system temporary directory using UUID-formatted filenames while simultaneously spawning a large number of threads, a pattern often used to widen race conditions for Time-of-Check Time-of-Use (TOCTOU) exploitation.
Detects the creation of applications or service principals in Azure AD that involve sensitive OAuth permissions (e.g., Mail.ReadWrite, Files.ReadWrite.All) when performed by users identified with elevated risk levels or outside of standard business hours.
Detects the creation of suspicious scheduled tasks using the 'schtasks.exe' utility. The rule flags tasks that are created from suspicious paths (e.g., Temp, ProgramData), tasks executing common script extensions (vbs, ps1, bat, hta, js), or tasks that masquerade as legitimate Windows or System update tasks.
Detects the creation of DLL files in suspicious locations (AppData, Temp, ProgramData, Users\Public, Downloads) that are initiated by specific processes commonly associated with software that might be vulnerable to DLL side-loading, such as Microsoft, Citrix, VMware, or Fortinet binaries, when those processes are executing from outside standard protected directories.
Detects the creation or modification of Windows Registry Run keys or the addition of files into the startup directory. These are common persistence mechanisms used by adversaries to ensure programs execute automatically upon system boot or user logon.
This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.
Detects the trojanized uxtheme.dll (Cavern Agent) dropped to a non-standard path and side-loaded via WinDirStat.exe
Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '../') in the destination path. This pattern is indicative of an attempt to escape the container filesystem boundary and write arbitrary files to the host system by exploiting vulnerabilities in the docker cp utility.
Detects a single authenticated user account or client performing a high volume of requests to sequential object IDs on the same API path within a short window. This pattern is characteristic of Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) exploitation, where an attacker attempts to gain unauthorized access to data records that do not belong to them by iterating through predictable numeric identifiers.
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
This rule detects the creation of Windows services or scheduled tasks that reference known file paths, names, or command-line indicators associated with the Turb00 loader, HijackLoader, SnappyClient, or Vidar malware families. It utilizes Windows Event logs (4697/4698) and Sysmon process creation events to identify persistence mechanisms being established by these threats.
This rule detects potential process injection activities associated with the HijackLoader (IDAT Loader) malware family. It monitors Sysmon event logs for sequences involving process creation, image loading, and inter-process manipulation, specifically flagging the use of CreateRemoteThread, QueueUserAPC, and process access patterns (such as writing thread rights) indicative of reflective DLL injection used to deliver payloads like Vidar.
Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for suspicious registry modifications in HKCU\Software\Classes associated with auto-elevating binaries (such as fodhelper.exe, computerdefaults.exe, or eventvwr.exe), followed shortly by the execution of these binaries or their child processes. This pattern is indicative of an adversary attempting to elevate privileges by hijacking the command registry keys used by these trusted Windows binaries.
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.
Detects the creation of scheduled tasks using the Windows schtasks utility, specifically looking for common adversarial naming conventions or patterns such as 'MiniJunk' or recursive task names, often used to establish persistence.
Detects the creation of or connection to the specific named pipe '\\pipe\\RoguePlanet', which is used as a synchronization and callback channel by the Nightmare Eclipse RoguePlanet exploit (CVE-2026-50656). This exploit leverages the named pipe to facilitate communication between a low-privileged exploit process and a SYSTEM-level Windows Error Reporting (WER) task payload during a local privilege escalation attempt.
Detects modifications to the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell' registry value. Attackers often modify this value to execute arbitrary malicious binaries or scripts upon user logon as a persistence mechanism, replacing the default 'explorer.exe'.
Page 23 of 401