Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the presence of the PowerShell cmdlet 'Register-ScheduledTask' within an HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating a scheduled task, potentially delivered via a web-based command and control channel or a malicious download.
This rule detects the presence of the PowerShell cmdlet 'New-ScheduledTask' and related parameters ('-action', '-trigger', '-taskname', '-settings') within the HTTP response body. This could indicate a system receiving instructions to create a scheduled task, potentially for persistence or execution of malicious code. The detection specifically looks for successful HTTP status code 200 responses.
This rule detects HTTP responses (status code 200) that contain the string 'schtasks' followed by '/run' and '/tn' (case-insensitive) in the response body. This pattern indicates the potential for a client system to receive instructions to execute a scheduled task, which could be used for persistence, lateral movement, or other malicious activities.
Detects process crashes within the Samsung 'libimagecodec.quram.so' library, which could indicate an exploitation attempt related to the LANDFALL spyware (CVE-2025-21042, CVE-2025-21043).
Detects DLL side-loading patterns associated with the Lazarus Group's Operation DreamJob campaign. This involves legitimate Windows executables loading malicious DLLs from non-standard paths.
Detects when a new administrator role assignment is created within Okta. This activity can indicate privilege escalation, where an attacker gains higher-level permissions, or persistence, where an attacker establishes a way to maintain access to the system over time.
Detects when an administrator role is assigned to a user or group within Okta. This could indicate privilege escalation or persistence by an attacker, or a legitimate administrative action.
This rule detects the usage of default credentials on assets by correlating vulnerability scan results from Qualys. Specifically, it looks for a predefined list of Qualys vulnerability IDs (QIDs) that indicate the presence of default credentials. The rule aims to identify systems that have not had their default passwords changed, which is a critical security hygiene practice.
Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Detects when a user creates a new secret within GitHub for an organization, environment, codespace, or repository. This activity is critical to monitor as secrets often contain sensitive credentials (e.g., API keys, tokens) that, if compromised or misused, can lead to unauthorized access, privilege escalation, or persistence within the GitHub environment. The rule specifically looks for audit log actions indicating the creation of these secrets.
This rule detects the loading of known vulnerable drivers by their file names. Adversaries often leverage these vulnerable drivers to achieve privilege escalation or persistence on a system, typically by exploiting a known vulnerability in the driver to execute arbitrary code in kernel mode. The list of driver file names included in the detection logic corresponds to drivers identified as vulnerable, often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks.
Detects the modification of a user group on a Fortinet FortiGate Firewall. This activity could be used by an attacker to grant themselves or other malicious accounts VPN access to a network, facilitating persistence or privilege escalation.
Detects when changes are made to the SSH certificate configuration of a GitHub organization, specifically the creation of an SSH certificate authority or the disabling of the requirement for members to use SSH certificates.
This rule detects changes to global permissions within Bitbucket. This includes requests to grant or remove global permissions, as well as the successful granting or removal of such permissions. Monitoring these events is crucial for identifying unauthorized privilege escalation or persistence attempts within a Bitbucket instance.
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
This rule detects when a user is added to the local 'admin' group on a macOS system using either the `dscl` or `dseditgroup` command-line utilities. It specifically looks for command-line arguments indicative of adding a user to the 'admin' group. There is a whitelist for legitimate MDM solutions like 'jamfmanager' to reduce false positives.
This rule detects failed user login attempts within Bitbucket. It specifically looks for audit events categorized as 'Authentication' with the action 'User login failed'. This type of event can indicate various activities, including legitimate users mistyping passwords, or malicious actors attempting to brute-force credentials or perform credential stuffing attacks against Bitbucket accounts.
This rule detects when Okta identifies new or unusual activity within the Admin Console. It specifically looks for 'policy.evaluate_sign_on' events targeting the 'Okta Admin Console' where Okta's internal heuristics (debugcontext.debugdata.behaviors or debugcontext.debugdata.logonlysecuritydata) flag the activity as 'POSITIVE' for unusual behavior. This can indicate an adversary attempting to gain or maintain access to administrative functions, or an administrator performing actions that are outside their typical patterns.
Detects when a new identity provider is created in Okta. This activity can be a legitimate administrative action but could also indicate an attacker attempting to establish persistence or bypass authentication mechanisms by creating a rogue identity provider.
Detects when a user in OneLogin assumes the identity of another user account. This could indicate an attacker using compromised credentials to impersonate another user or an insider abusing privileges.
Page 241 of 401