Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule identifies a critical security misconfiguration or bypass scenario within Azure Privileged Identity Management (PIM) where a privileged role can be activated without requiring multi-factor authentication (MFA). This can significantly increase the risk of unauthorized access and privilege escalation if an attacker compromises credentials for an account with PIM roles.
This rule detects instances where a user denies a multi-factor authentication (MFA) prompt. This could indicate that an attacker has successfully obtained the user's password and is attempting to gain unauthorized access, prompting the legitimate user for MFA approval. The user's denial signals that they did not initiate the login attempt.
Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Detects successful RDP logons originating from public IP addresses. This can indicate an exposed RDP port being accessed externally, potentially by an attacker.
This rule detects the remote creation of scheduled tasks by monitoring access to the 'ATSVC' named pipe within the IPC$ share. Specifically, it looks for Event ID 5145, indicating a detailed file share access, where the ShareName is '\\*\IPC$', the RelativeTargetName is 'atsvc', and the AccessList contains 'WriteData'. This activity is characteristic of tools like 'at.exe' or direct API calls used to schedule tasks remotely.
This rule detects attempts to load malicious DLLs into the LSASS process by modifying undocumented registry keys. Specifically, it looks for modifications to 'DirectoryServiceExtPt' or 'LsaDbExtPt' registry keys that are not associated with the legitimate 'ntdsa.dll' or 'lsadb.dll' files, which are typically loaded by 'lsass.exe' on domain controllers. This technique can be used for privilege escalation, persistence, and credential access.
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries.
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Detects when new credentials (certificates or secrets) are added to an existing application or service principal within Azure/Entra ID. This activity, if not part of expected workflows, could indicate a malicious actor establishing persistence or escalating privileges by adding their own credentials to an application.
Monitors for successful device registration or join events in Azure AD where Multi-Factor Authentication (MFA) was not performed. This could indicate an adversary bypassing MFA to gain persistent access or escalate privileges by registering a new device.
This rule detects the creation or modification of local user accounts and changes to remote authentication configurations on Cisco devices. It specifically looks for keywords 'username' and 'aaa' in Cisco AAA logs, indicating actions related to account management or authentication settings.
Detects the load of the WinRing0 driver, which is known to be vulnerable and has been exploited by threat actors, crypto miners (like XMRIG), and other malware for privilege escalation. The detection is based on specific file names or a known IMPHASH associated with the driver.
This rule detects the creation of a child process with SYSTEM privileges where the parent process was running under a LOCAL SERVICE or NETWORK SERVICE account. This behavior is often indicative of privilege escalation techniques such as Rotten Potato or RogueWinRM, which exploit vulnerabilities to elevate privileges from service accounts to SYSTEM.
Detects the creation of WMI event subscriptions, which can be used as a persistence mechanism by adversaries. This rule specifically looks for Sysmon Event IDs 19 (WmiEventFilter activity), 20 (WmiEventConsumer activity), and 21 (WmiEventConsumerToFilter activity), indicating the creation or modification of WMI event filters, consumers, or their binding.
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
Detects remote RPC calls to create or execute a scheduled task via the Advanced Telephony Service (ATSvc) interface. This activity can be indicative of lateral movement, privilege escalation, or persistence mechanisms used by adversaries.
Detects the deletion of an AWS SAML provider, which could indicate an attacker attempting to disrupt administrative or security team access. By removing the SAML provider, an adversary can hinder the ability of security personnel or system administrators to investigate and respond during an attack.
This rule identifies when a user or application modifies the federation settings on a domain within Azure Active Directory. Such modifications can impact how users authenticate and can be leveraged by attackers for persistence, privilege escalation, or defense evasion by altering trust relationships.
Detects when changes are made to Privileged Identity Management (PIM) role settings within Azure Active Directory. This could indicate an attempt to alter how privileged roles are managed, potentially to facilitate unauthorized access or persistence.
This rule identifies when a privileged role assignment occurs in Azure Active Directory (now Microsoft Entra ID) without utilizing Privileged Identity Management (PIM). Such assignments bypass the just-in-time access and approval workflows provided by PIM, potentially indicating an attacker attempting to establish persistent privileged access or escalate privileges outside of established security controls.
Detects the deployment of container workloads in Google Cloud Platform (GCP) that utilize the 'break-glass' flag to bypass Binary Authorization controls. This indicates an intentional override of security policies designed to ensure only trusted images are deployed, potentially allowing unauthorized or malicious container images to run.
Page 246 of 401