Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects when an account that has been disabled or blocked attempts to sign in. This could indicate an attacker attempting to use compromised credentials for an account that is no longer active or has been locked out due to suspicious activity.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root without authentication by specifying a user ID of -1 or 4294967295.
This rule detects when a member is removed from a security-enabled global group in a Windows environment. This activity is captured by Event IDs 633 and 4729 in the Windows Security event log. Such an action could indicate an attempt to reduce an account's privileges, remove an adversary's access, or modify group memberships for other malicious purposes.
Detects the loading of the System Informer tool's driver, 'SystemInformer.sys', by checking for its file name or specific SHA256 hashes. System Informer is a legitimate system monitoring tool that can be used by adversaries for reconnaissance or to gain deeper system insights, making its driver load a potential indicator of compromise or unauthorized activity.
Detects the load of HackSys Extreme Vulnerable Driver (HEVD.sys), an intentionally vulnerable Windows driver often abused by threat actors for privilege escalation and other malicious activities. The rule identifies the driver by its filename and known IMPHASH values.
This rule detects the creation of files with a '.scr' extension, which are typically Windows screensaver executable files. Adversaries may create or modify these files to establish persistence by executing malicious content when user inactivity triggers the screensaver. The rule includes filters to reduce false positives from known legitimate processes creating screensaver files, such as Kindle.exe, Symantec Endpoint Protection's ccSvcHst.exe, and TiWorker.exe creating uwfservicingscr.scr.
Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write. This rule specifically looks for the execution of 'schtasks.exe' with command-line arguments indicative of modifying an existing scheduled task's properties, such as changing the user account and password, which could be abused in privilege escalation scenarios.
Detects the creation of specific files associated with the Pingback backdoor, which is known to establish an ICMP tunnel for command and control (C2) communications. The rule specifically looks for 'updata.exe' being created and 'C:\Windows\oci.dll' as the target filename, as described in the Trustwave report.
Detects the creation of a scheduled task using 'schtasks create' in conjunction with 'wscript' and '/e:vbscript', which is a known persistence mechanism used by the ACTINIUM threat group.
This rule detects the loading of specific DLL names known to be used by the SVR-attributed GraphicalProton backdoor. The rule looks for an 'ImageLoaded' event where the DLL name ends with one of the predefined malicious DLL names.
This rule detects specific DLL sideloading activity observed to be used by the Diamond Sleet APT group. It looks for the loading of 'Version.dll' by 'clip.exe' or 'DSROLE.dll' by 'wsmprovhost.exe' when these executables and DLLs are located in the 'ProgramData' directory. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their crafted DLLs.
Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.
This rule detects failed attempts to elevate privileges (PIM activation) in Azure Active Directory from devices that are not designated as Privileged Access Workstations (PAW) or Secure Access Workstations (SAW). It specifically looks for messages indicating 'Add member to role completed (PIM activation)' in the sign-in logs, combined with conditions that identify non-compliant devices, unapproved IP addresses, unapproved countries, or unapproved device information. The rule is designed to flag suspicious privilege elevation attempts that originate from unauthorized or untrusted environments, which could indicate a compromised account or an attempt to bypass security controls.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
This rule detects when a user registers security information, which indicates a change to their authentication method. This could be an attacker adding an authentication method to a compromised account to maintain persistent access.
This rule detects sign-in attempts to Azure Active Directory from devices that are marked as non-compliant. Non-compliant devices typically lack required security configurations, updates, or policies, and their use for authentication can indicate a potential security risk, such as a compromised device or an attempt to bypass security controls.
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
Detects suspicious changes to file privileges using `chown` to set ownership to root and `chmod` to enable setuid (u+s) or setgid (g+s) bits. This activity can be indicative of privilege escalation or persistence mechanisms where an adversary attempts to run code with elevated privileges.
Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472, also known as Zerologon. This vulnerability allows an unauthenticated attacker to gain domain administrator privileges.
Detects the installation of a PDQDeploy service on a machine. PDQDeploy is a legitimate system management tool that can be leveraged by attackers to remotely install packages or execute commands on target machines, leading to persistence or privilege escalation.
Page 251 of 401