Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects when an MDE offboarding package is downloaded.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
Detects the loading of version.dll from a non-standard directory, a technique associated with DLL Sideloading. This specific variant was observed being used by a loader for TorNet and PureHVNC.
Detects suspicious process creation activities executed by the SYSTEM user, specifically looking for known malicious programs or command-line parameters often associated with credential dumping, defense evasion, and privilege escalation techniques. This includes the use of tools like Mimikatz, Rubeus, ProcDump, and various PowerShell obfuscation methods, as well as commands related to shadow copy deletion and registry hive saving.
This rule detects modifications to the HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CLSID}\InProcServer32 registry key where the RegistryValueData ends with ".dll" and does not point to common system directories (%systemroot%, C:\Program Files (x86)\, C:\Program Files\). This behavior is indicative of CLSID hijacking, a technique used by adversaries to achieve persistence or privilege escalation by redirecting legitimate COM object calls to a malicious DLL.
Detects potential COM object hijacking via modification of default system CLSID.
Detects when an API access service account is granted domain authority within Google Workspace. This action can be used by an attacker to gain persistent and elevated access to an organization's Google Workspace data and services by allowing a service account to impersonate users across the domain.
Detects the creation of a specific COM object registry key in the HKEY_CURRENT_USER hive to hijack the legitimate 'twinapi.dll' component. This persistence technique (T1546.015) was used by the ForumTroll APT group to load the LeetAgent and Dante spyware.
Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux. This includes using the `personality` syscall with the ADDR_NO_RANDOMIZE flag, modifying the `/proc/sys/kernel/randomize_va_space` file, or executing the `sysctl` command to set `kernel.randomize_va_space=0`. Disabling ASLR can be used by attackers to bypass memory protection mechanisms and make memory corruption attacks more reliable, often during exploit development.
Detects Component Object Model (COM) hijacking used by the ForumTroll APT group for persistence. This rule identifies modifications to the registry where a malicious DLL is registered to be loaded by legitimate processes by overriding the CLSID for twinapi.dll in the HKEY_CURRENT_USER hive.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects potential DLL sideloading associated with the Lazarus Group's DreamLoader campaign. This involves legitimate Windows executables (wkspbroker.exe, wksprt.exe) being executed from non-standard directories shortly after a DLL is created in the same location.
Detects an NTLM authentication attempt with an empty username field. This is a key indicator of the NTLM LDAP authentication bypass vulnerability (CVE-2025-54918), where an attacker coerces a SYSTEM account authentication and relays it to LDAP.
This rule detects suspicious execution of 'RUNDLL32.EXE' with specific command-line arguments. It looks for instances where 'RUNDLL32.EXE' is executed with both a backslash and a comma in the command line, combined with specific DLL names or keywords like 'iamnotarobot.dll', 'checkme.dll', 'machinerie.dll', 'humanCheck', or 'verifyme'. This pattern is often indicative of malicious DLL loading or persistence mechanisms.
Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion. Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries. Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.
Detects user sign-ins occurring outside of predefined normal business hours and from locations not explicitly whitelisted. This rule aims to identify potentially unauthorized access attempts or compromised accounts being used at unusual times or from unexpected geographies.
Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This behavior has been associated with exploitation of WinRAR path traversal vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
Detects a User Account Control (UAC) bypass attempt using the CMSTP COM interface. This specific rule looks for the process chain associated with the ValleyRAT campaign, where bypass.exe uses this technique to launch Nvidia.exe with elevated privileges.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
CyberSecurityNews has reported a raising case about a new wave of phishing emails masquerading as breach notifications from LastPass.
To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access.
In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system.
Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks.
This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access.
In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system.
Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks.
This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
Page 242 of 401