Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the start or reload of a service on Linux systems using 'systemctl' or 'service' commands. This can be indicative of persistence mechanisms or privilege escalation attempts where adversaries modify or create services to execute malicious payloads.
Detects attempts to enable the root account on macOS systems using the 'dsenableroot' command-line utility. This action can be used for persistence, privilege escalation, or defense evasion by adversaries.
This rule detects modifications to specific registry keys related to shell open commands for 'ms-settings' and 'exefile'. These modifications are commonly used for persistence and UAC bypass techniques, particularly those leveraging tools like UACMe and targeting executables such as fodhelper.exe, computerdefaults.exe, and slui.exe. The rule looks for changes to 'SymbolicLinkValue', 'DelegateExecute', and '(Default)' values within these registry paths, while filtering out empty default values.
This rule detects attempts to bypass User Account Control (UAC) by modifying the Windows Registry related to the 'mscfile' handler. Specifically, it looks for changes to the default command associated with '.msc' files, which can be abused by 'eventvwr.exe' to execute arbitrary code with elevated privileges without a UAC prompt. The filter excludes legitimate modifications where the 'Details' field starts with '%SystemRoot%\system32\mmc.exe "%1" %', aiming to reduce false positives from standard system operations.
Detects the creation of scheduled tasks with specific names ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in March 2018.
This rule detects the use of the CreateRemoteThread API in conjunction with the LoadLibrary function to inject a DLL into another process. Specifically, it looks for events where a remote thread is created, the starting module is 'kernel32.dll', and the starting function is 'LoadLibraryA'. This combination is a common technique for dynamic-link library (DLL) injection, often used by malware to execute arbitrary code within the context of a legitimate process, evade defenses, and potentially elevate privileges.
Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\". Attackers often use such directories for staging purposes. This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation. Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
Detects the S3 Browser utility creating an IAM User or AccessKey in AWS. This activity can be indicative of an attacker establishing persistence or escalating privileges within an AWS environment.
This rule detects when guest users are invited to the tenant by individuals who are not on an approved list of inviters. This helps identify unauthorized or suspicious external user invitations that could lead to unauthorized access or compromise.
This rule identifies instances where a user has been assigned a privileged role within Azure Active Directory (now Microsoft Entra ID) but is not actively using that role. This is detected by monitoring 'redundantAssignmentAlertIncident' risk events from the Azure PIM (Privileged Identity Management) service. Such alerts can indicate over-privileged accounts, potential misconfigurations, or accounts that could be targeted for privilege escalation if compromised.
This rule detects the execution of the 'esxcli' command on an ESXi host with specific arguments to assign administrative permissions to an account. The command line must contain 'system', 'permission', 'set', and 'Admin', indicating an attempt to modify user permissions to grant administrative privileges. This activity is highly suspicious as it can lead to privilege escalation or persistence on the hypervisor.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root by specifying a user ID of -1 or 4294967295 (NO_UID_T) with the '-u' option, bypassing the sudoers policy.
This rule detects the use of the PlistBuddy utility to modify LaunchAgents or LaunchDaemons on macOS. Specifically, it looks for command-line arguments that include 'RunAtLoad' and 'true', along with either 'LaunchAgents' or 'LaunchDaemons', indicating an attempt to establish persistence by configuring a program to run automatically at system startup or user login.
Detects attempts to create and add an account to the admin group via the `sysadminctl` utility on macOS. This action can be used for persistence, privilege escalation, or defense evasion by creating a new administrative user.
This rule detects when a new member is added to a security-enabled global group in a Windows environment. This activity is significant because adding users to such groups can grant them elevated privileges or access to sensitive resources, making it a common action for adversaries attempting privilege escalation or persistence.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects modifications to Group Policy Object (GPO) attributes, specifically 'gPCMachineExtensionNames', that are indicative of adding privileges to user accounts or adding users as local administrators. This is identified by the presence of specific GUIDs ('827D319E-6EAC-11D2-A4EA-00C04F79F83A' or '803E14A0-B4FB-11D0-A0D0-00A0C90F574B') within the 'AttributeValue' field of EventID 5136. These GUIDs are associated with Group Policy extensions that can be abused for privilege escalation.
Detects unusual processes accessing `desktop.ini` files. Adversaries can leverage `desktop.ini` to alter how Windows Explorer displays a folder's content (e.g., renaming files or changing icons) without modifying the actual files on disk. This can be used for persistence, privilege escalation, or to hide malicious files.
This rule identifies the suspicious use of the AWS Security Token Service (STS) API call `GetSessionToken`. This API call is used to request temporary, limited-privilege credentials for an IAM user or role. Attackers may use `GetSessionToken` to generate temporary tokens to move laterally within an AWS environment or escalate privileges by assuming roles with broader permissions. The rule specifically looks for `GetSessionToken` calls made by an `IAMUser`.
Detects when users successfully authenticate to Azure AD using only single-factor authentication, indicating that MFA was not required or was bypassed. This could be due to misconfiguration, an attacker bypassing MFA, or legitimate exceptions.
Page 248 of 401