Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects instances where the Console Host process (conhost.exe) is executed at a System integrity level with a parent process of the Windows Error Reporter (wermgr.exe). This pattern is atypical as conhost.exe typically runs within the context of the user session or the initiating process, and spawning it from wermgr.exe at System level may indicate an attempt to hide a console window or manipulate system processes via an elevated parent.
Detects unauthorized child process creation by the Windows Error Reporting Manager (wermgr.exe). The rule identifies scenarios where wermgr.exe, executed under the SYSTEM context via the QueueReporting scheduled task (often abused in the RoguePlanet exploit chain), spawns interactive shells or command processors like cmd.exe, powershell.exe, or cscript.exe. Legitimate instances of wermgr.exe do not spawn interactive user interfaces or shells.
Detects the execution of known Remote Monitoring and Management (RMM) tools (AnyDesk, SyncFuture, QuickAssist, etc.) when launched by suspicious or untrusted parent processes. Additionally monitors for non-standard installation paths for AnyDesk and the creation of persistence registry keys for these RMM tools.
Detects specific User Account Control (UAC) bypass techniques involving fodhelper.exe, eventvwr.exe, and sdclt.exe, often used in conjunction with PowerShell 'RunAs' elevation to install system-level tools like Tailscale or OpenSSH, as observed in Operation Poisson.
Detects the execution of 'kustomize' with the '--helm-command' flag configured to use a non-standard binary or script. When triggered within the context of an Argo CD repo-server, this behavior indicates a potential exploitation attempt of CVE-2024-31989, which allows for arbitrary command execution under the repo-server process context by coercing Kustomize to execute malicious files.
Detects persistence mechanisms used by Vidar/SnappyClient (Operation Turb00), specifically the creation of a malicious Windows service named CadenceOptimizer and the hijacking of a Svchost service-group (Brn_Agent) to load a malicious DLL (agt.dll) from the ProgramData directory with SYSTEM privileges.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects the creation of a Windows Registry Run key containing a misspelling of 'Microsoft Corporation' (as 'Microsoft Coporation') which is configured to launch 'fixmapi.exe'. This pattern is indicative of a persistence mechanism masquerading as a legitimate Microsoft process.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
Detects a persistent loading pattern attributed to the Kimsuky threat group. The rule monitors for the creation of a hidden scheduled task named 'Edge Updater' that triggers a wscript.exe process executing a disguised VBScript file named with an 'OfficeUpdater' naming convention. This detection covers both the task registration (Event ID 4698) and the subsequent execution of the malicious script via wscript.exe.
Detects the process Crisp.exe creating a legacy AT-style scheduled task job file in the C:\Windows\Tasks directory while simultaneously loading mstask.dll. This behavior is indicative of persistence establishment, specifically associated with the Operation Turb00 HijackLoader sideloading chain which utilizes legacy task scheduling to re-execute AlphVector.exe.
Detects the abuse of the Windows Error Reporting (WER) service mechanism, specifically targeting the 'QueueReporting' scheduled task. Attackers may employ junction-based path redirection to execute a malicious wermgr.exe binary located outside of the standard system directory. The rule identifies instances where wermgr.exe is running from non-standard locations, or running at SYSTEM integrity level spawned by standard task-related parent processes, which indicates a potential privilege escalation or persistence attempt (linked to CVE-2026-50656).
This rule detects activities indicative of the RoguePlanet exploit, which utilizes NTFS junction swapping to stage malicious operations. It monitors for the creation of suspicious system-like directories within temporary paths, writing of executables (like wermgr.exe) to those paths, unprivileged manipulation of the Windows Defender Quarantine directory, and virtual disk image mounting from user-writable directories.
Detects indicators of activity associated with 'RoguePlanet', including specific command-line strings, named pipes, process spawning behaviors related to Microsoft Defender (MsMpEng.exe), and suspicious staging patterns involving 'wermgr.exe' in temporary directories.
Detects attempts to perform container escapes or escalate privileges within a Gitea Actions runner environment. The rule monitors for the execution of dangerous container options (e.g., --pid=host, --privileged, --cap-add=ALL) in CI/CD workflow configurations, the spawning of 'nsenter' by the runner process, and writes to sensitive host system paths from containerized processes.
Detects anomalous process execution chains originating from the Gitea server or Gitea act-runner processes following the exploitation of CVE-2026-20896. This vulnerability allows an attacker to bypass authentication using a forged X-WEBAUTH-USER header when REVERSE_PROXY_TRUSTED_PROXIES is insecurely configured. The rule identifies subsequent command-line activity such as spawning shells, using network utilities (wget, curl, netcat), or executing Gitea administrative commands by unauthorized child processes.
Detects suspicious activity related to OAuth2PermissionGrant operations, specifically looking for a high volume of successful consent grants by a single user within a short timeframe. This could indicate an attacker attempting to gain broad access to resources by granting permissions to a malicious OAuth application.
Detects process hollowing behavior where a ClickFix-delivered loader payload targets legitimate Windows host processes like explorer.exe or svchost.exe. The detection looks for a combination of memory operations (NtUnmapViewOfSection, WriteProcessMemory, PAGE_EXECUTE_READWRITE allocation) and thread control (SetThreadContext, ResumeThread) indicative of malicious code injection.
Detects signs of process hollowing targeting ServiceModelReg.exe, a technique used by ResiLoader to execute the StealC information stealer. The rule monitors for suspicious cross-process access (high-privilege handles), remote thread creation, and anomalous module loading patterns within the target process.
Detects the execution of known Windows binaries (fodhelper.exe, eventvwr.exe, computerdefaults.exe) which are frequently abused for User Account Control (UAC) bypass by exploiting their auto-elevation capability. These binaries are monitored as either the parent process or the target image, which is a common indicator of a UAC bypass attempt.
Page 25 of 401