Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects when an AWS Route 53 domain is transferred to another AWS account. This activity could indicate an attempt by an adversary to maintain persistence or exfiltrate domain control by moving it to an account they control.
This rule identifies suspicious activity related to Security Assertion Markup Language (SAML) in AWS. Specifically, it looks for two events: `AssumeRoleWithSAML` from the `sts.amazonaws.com` service and `UpdateSAMLProvider` from the `iam.amazonaws.com` service. An adversary could leverage these actions to gain unauthorized access, establish persistence, or escalate privileges within an AWS environment by manipulating SAML providers or assuming roles via SAML.
This rule detects the creation of new systemd service unit files in standard systemd directories. Adversaries often create or modify systemd services to establish persistence or escalate privileges by executing malicious code at system startup or when specific events occur. The rule specifically looks for file creation events in '/usr/lib/systemd/system/', '/etc/systemd/system/', and user-specific '/.config/systemd/user/' directories, which are common locations for systemd unit files.
Detects the execution of the 'doas' utility on Linux systems. 'doas' allows standard users to execute commands as another user, typically root, similar to 'sudo'. This can be used by adversaries for privilege escalation or defense evasion.
Detects attempts to add a user account to the 'admin' group on macOS using the `dseditgroup` utility, which grants administrative privileges to the added user. This action can be used for persistence, privilege escalation, or defense evasion by an attacker.
This rule detects modifications to Cisco device configurations that could be used by an adversary for persistence, privilege escalation, or to impact system availability. Specifically, it looks for commands related to enabling HTTP/HTTPS servers, configuring Kron jobs (scheduled tasks), modifying access lists, archiving configurations, and setting NTP servers. These commands, if used maliciously, can allow an attacker to maintain access, execute arbitrary commands, control network access, or disrupt time synchronization.
This rule detects specific DCE-RPC function calls that are indicative of persistence techniques on a remote Windows system. The detected operations include adding print monitors or print processors, and creating processes with logon credentials, which can be abused by adversaries to maintain access or execute code.
Detects non-system users performing privileged operations on the Service Control Manager (SCM) database, specifically taking ownership of the 'servicesactive' object. This could indicate an attempt to manipulate Windows services for privilege escalation or persistence.
Detects when a user account is added to the local 'Administrators' group on a Windows system. This activity is critical for privilege escalation and persistence, as it grants the added user administrative rights. While it can be a legitimate administrative action, it is also a common technique used by attackers to maintain control and elevate privileges after initial compromise.
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
This rule detects the creation of an executable named 'Get-Variable.exe' within the 'Local\Microsoft\WindowsApps\' directory. This is a suspicious activity because 'Get-Variable' is a legitimate PowerShell cmdlet, not an executable. Adversaries can exploit the Windows application execution alias feature, where executables in the WindowsApps directory can be prioritized over PowerShell cmdlets with the same name. By placing a malicious 'Get-Variable.exe' in this path, an attacker can trick the system into executing their malicious binary instead of the intended PowerShell cmdlet when 'Get-Variable' is invoked, leading to persistence or privilege escalation.
Detects command line parameters used by ADCSPwn, a tool designed to escalate privileges in an Active Directory network. This tool achieves privilege escalation by coercing authentication from machine accounts and relaying it to the certificate service.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
Detects global permissions change activity.
Detects the DLL side-loading of 'jli.dll' by 'keytool.exe' from common malware staging directories. This is a more generic version of a rule detecting a technique used by ValleyRAT in Operation Silk Lure.
This rule detects the installation of a Windows service named 'NtsSrv' with an ImagePath ending in ' LocalService'. This specific service name and image path pattern are associated with the StoneDrill wiper malware, as described in Kaspersky's research.
Detects the deactivation or disabling of the Windows Scheduled Defragmentation task, which has been observed as a tactic used by the Slingshot APT group to hinder forensic analysis or system maintenance.
Detects suspicious VBScript execution patterns, specifically looking for a combination of keywords often used by UNC2452 (NOBELIUM) in their malware. The rule identifies command lines containing 'Execute', 'CreateObject', 'RegRead', 'window.close', and '\Microsoft\Windows\CurrentVersion', while filtering out common legitimate uses involving the 'Run' registry key path to reduce false positives.
This rule detects the execution of the extended stored procedure backdoor named Maggie in the context of Microsoft SQL server by looking for specific event IDs and the string 'maggie' in the event message.
This rule detects remote procedure call (RPC) activity related to the creation or execution of scheduled tasks using the SASec interface. Specifically, it looks for Event ID 3 from the RPC Firewall log source, where the InterfaceUuid matches '378e52b0-c0a9-11cf-822d-00aa0051e40f' (which corresponds to the Task Scheduler service) and the OpNum is either 0 (SchRpcRegisterTask) or 1 (SchRpcRunTask). This indicates an attempt to remotely register or run a scheduled task, which can be a method for lateral movement, execution, or persistence by adversaries.
Detects the S3 Browser utility performing reconnaissance by checking for existing AWS IAM Users without a LoginProfile defined, and subsequently creating a LoginProfile if one is not found. This behavior has been associated with the Guivil threat actor.
Page 250 of 401