Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of a VBScript file using wscript.exe, where the script is located in the user's Startup folder. This pattern is commonly used by malware to maintain persistence by ensuring the script executes automatically upon user logon.
Detects attempts to exploit an authorization bypass vulnerability in MyBB (specifically observed in version 1.8.40) where a non-administrative ACP account can assign users to the administrator group (gid=4) by manipulating POST requests to the user-add or user-edit endpoints.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility where the command line contains the specific strings 'MiniJunk' or 'MiniBrowse'. This pattern is often associated with the installation or persistence mechanisms of specific malicious software.
Detects exploitation attempts of the MyBB limited Admin CP-to-Admin privilege escalation vulnerability. The detection looks for unauthorized HTTP POST requests to the user management module that assign the Administrator group (gid=4) to a new user, or access to sensitive super-admin-only modules by accounts that should not have such permissions. It also flags requests containing known PoC artifact identifiers.
This rule detects persistence mechanisms established by either modifying common Windows 'Run' registry keys or by placing executable files within user Startup folders. These techniques are commonly used by malware and adversaries to ensure their code executes automatically upon user logon.
Detects the loading of the known vulnerable OPSWAT AppRemover driver (pcdhost.sys). This driver is often abused in Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks, such as those performed by ResiLoader, to execute code in kernel mode and bypass security controls, ultimately allowing the termination of protected security processes.
Detects the creation of the named pipe '\pipe\RoguePlanet', which is specifically utilized by the RoguePlanet CVE-2026-50656 exploit. The exploit uses this pipe for synchronization during a TOCTOU race condition against MsMpEng.exe. Once the race is won, a SYSTEM-level payload (typically masquerading as a child process of wermgr.exe) uses this pipe to verify the originating session and subsequently spawn an interactive shell as NT AUTHORITY\SYSTEM. This pipe name is unique to this exploit and not used by legitimate software.
This rule detects potentially malicious MySQL database operations involving sensitive file access or suspicious data exportation. It monitors for the use of 'INTO OUTFILE' commands pointing to sensitive paths (like /var/lib/mysql-files/) or the use of 'LOAD_FILE' commands to access system files such as /var/run/docker.sock, /proc/1/cgroup, or /proc/1/mountinfo, which are indicative of attempts to exfiltrate database content or escape a container environment.
Detects the execution of known command-line artifacts and tools associated with direct and indirect system call resolution, such as SysWhispers, HellsGate, and HellHall. These techniques are commonly employed by adversaries to bypass user-mode EDR hooks by invoking NT syscalls directly.
Detects TrymeLocker modifying the Image File Execution Options (IFEO) for accessibility binaries to establish a login screen backdoor with SYSTEM privileges.
This rule detects potential malicious process injection originating from web browsers (chrome.exe or msedge.exe) when followed by the creation or access of a hex-named text file in the C:\ProgramData directory within a 5-minute window. This behavior often suggests a staged attack where a browser process is used to inject malicious code, and subsequently reads or interacts with a dropped file used for persistence or command-and-control communication.
Detects the execution of 'ElevatorShellCode.exe' or the presence of 'ICMLuaUtil' in command-line arguments. 'ICMLuaUtil' is a known Windows COM interface frequently abused for UAC bypass and privilege escalation, while 'ElevatorShellCode' is indicative of suspicious tools attempting to gain higher integrity levels.
Detects the loading of a potentially vulnerable or unauthorized third-party kernel driver from outside the standard system driver directory, followed shortly (within 30 minutes) by the termination of security product processes or services. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation, often used to impair security tools and blind EDR/antivirus solutions.
Detects potentially malicious activity within Microsoft 365 involving the creation of inbox rules for message forwarding/redirection, modifications to mailbox forwarding configurations, or mass outbound email sending. These actions are common indicators of persistent access, email exfiltration, or automated reconnaissance after account compromise.
Detects the presence and execution of components associated with the 'Exploitarium' toolkit, a collection of exploit harnesses and proofs-of-concept. The rule monitors for process execution of specific filenames, file creation events, persistence via registry-based service installation, and image loads related to the toolkit's binaries.
Detects the modification of the 'ServiceDLL' Registry value for a Windows service to a path that resides outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. This behavior is often associated with service hijacking or persistence techniques where an adversary points a service to a malicious DLL for execution.
This rule detects the use of GSocket and GS-Netcat utilities, which are often used for creating reverse shells and persistent network tunnels. It monitors for either direct network connections associated with these tools or command-line activity indicating these tools are being configured for persistence using cron jobs, systemd services, or @reboot triggers.
Detects the creation of a registry run key named 'Financeiro' under the Windows 'CurrentVersion\Run' path. This specific registry value is a known indicator of persistence mechanism utilized by the Ousaban banking trojan.
Detects modification of user-level Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) specifically involving suspicious files, components, or potential masquerading attempts related to common startup applications like OneDrive.
Detects instances where a trusted process (defined by a signed executable) loads a DLL that is either unsigned, untrusted, or signed by a different entity than the parent process. This behavior is commonly associated with DLL hijacking or side-loading attacks originating from suspicious paths such as user profile directories, temporary folders, or public download areas.
Detects instances of CreateRemoteThread API calls targeting sensitive host processes (svchost.exe, explorer.exe, lsass.exe, etc.) where the source process is not a recognized system component. This behavior is indicative of reflective DLL injection, a technique often used to execute code within the address space of a remote process to bypass security controls or user-mode hooks.
Page 24 of 401