Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects attempts to modify the ImagePath value of a Windows service using the 'reg.exe' utility. Adversaries may hijack existing service registry entries to execute their own malicious payloads, leveraging flaws in permissions to redirect the service's executable to one they control. This allows them to achieve persistence and potentially privilege escalation when the service starts.
Detects the creation of new scheduled tasks via commandline using `schtasks.exe` that specifically call `OpenSSH` components (`sshd.exe` or `ssh.exe`) with parameters indicative of establishing a reverse SSH tunnel. This activity suggests an adversary is attempting to establish persistence and command-and-control by creating a scheduled task to maintain a connection to their server.
Detects the deletion of registry entries within the `.*\shell\open\command` keys. This activity is often associated with COM hijacking, where an attacker modifies these keys to execute their malicious code instead of legitimate applications. The deletion of these keys could indicate an adversary attempting to remove traces of their COM hijacking activities.
This rule detects the creation or modification of the 'AppCertDlls' registry key. Adversaries can abuse this registry key to achieve persistence and privilege escalation by causing a malicious DLL to be loaded and executed in the context of other processes. The rule specifically looks for changes to the 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls' key or its potential rename.
Detects the creation of a suspicious scheduled task named "CaptureService" that is set to run every 11 minutes. This specific combination of task name, frequency, and executable (rundll32.exe) is indicative of a known persistence technique.
Detects suspicious administrative activities on F5 BIG-IP devices, such as failed logins or configuration changes. This is based on recommendations from F5 in response to a security incident disclosed in October 2025 where a threat actor gained access to BIG-IP development environments. F5 advised customers to enhance monitoring for admin logins, failed authentications, and privilege and configuration changes.
Detects the execution of 'more.com' as a parent process and 'vbc.exe' as a child process. This specific process tree behavior has been observed in samples related to the Lummac Stealer, where the Lummac payload is injected into the 'vbc.exe' process.
Detects the creation or modification of a custom protocol handler in the Windows Registry with the name "rogue" and a specific CLSID. This activity has been observed as a persistence mechanism used by the Forest Blizzard APT group (also known as Star Blizzard or COLDRIVER). By setting a custom protocol handler, the adversary can execute arbitrary code when a specially crafted URI is accessed.
Detects suspicious child processes created by CrushFTP, which could indicate the exploitation of a Remote Code Execution (RCE) vulnerability like CVE-2025-54309. The rule specifically looks for PowerShell, cmd, bitsadmin, certutil, mshta, cscript, or wscript processes spawned by CrushFTP, often with command-line arguments indicative of malicious activity (e.g., IEX, encoded commands for PowerShell, or common system commands for cmd).
Detects when a transfer lock was removed from an AWS Route 53 domain. This action is typically performed when intending to transfer the domain to a different registrar, but it can also be an indicator of malicious activity if unauthorized. Disabling the transfer lock makes the domain vulnerable to unauthorized transfers, which could lead to domain hijacking or redirection of traffic.
This rule monitors and alerts when a user is added to the 'Global Administrator' or 'Device Administrator' roles within Azure Active Directory. These roles grant highly elevated privileges, making this activity critical for detecting potential persistence, privilege escalation, or initial access attempts by adversaries. The detection logic specifically looks for 'Add member to role' operations within the RoleManagement category, targeting the unique identifiers for these two sensitive administrative roles.
Detects when a configuration change is made to an application's AppID URI in Azure Active Directory (now Microsoft Entra ID). This change can be indicative of an adversary attempting to modify an application's identity to facilitate malicious activities such as phishing, unauthorized access, or maintaining persistence.
Detects when a user is removed from a privileged role in Azure AD. Bulk changes should be investigated as they could indicate an adversary attempting to remove legitimate administrators or clean up their tracks after gaining access.
Detects when a user successfully resets their own password within Azure Active Directory. This rule specifically looks for 'UserManagement' category events with a 'Success' status, initiated by a 'UPN' (User Principal Name) and targeting a 'UPN' with an 'ActivityType' containing 'Password reset'.
Identifies when an account in a privileged role has not signed in for a specified number of days, indicating a potentially stale or unused privileged account. Such accounts can be a security risk if compromised, as they might not be actively monitored.
This rule detects sign-in attempts to Azure AD where the authentication requirement was single-factor, the sign-in was successful (ResultType: 0), the network location details were empty (indicating an unknown or unclassified location), and the device ID was also empty (indicating an unknown or unregistered device). This combination suggests a sign-in from an unknown device and potentially an untrusted location, which could be indicative of an adversary attempting to gain initial access or maintain persistence.
Detects failed attempts to sign in to disabled accounts within Azure Active Directory. This could indicate an attacker attempting to use compromised credentials for an account that has been deactivated, or an attempt to bypass security controls by targeting dormant accounts.
This rule detects unusual authentication interruptions in Azure Active Directory sign-in logs. Specifically, it looks for three types of ResultType and ResultDescription combinations: '50097 - Device authentication is required', '50155 - DeviceAuthenticationFailed', and '50158 - ExternalSecurityChallenge - External security challenge was not satisfied'. These events indicate that an authentication attempt was interrupted or failed due to device-related issues or an unmet external security challenge, which could be indicative of an adversary attempting to bypass authentication mechanisms or encountering unexpected security controls.
This rule detects successful user authentications from your Azure AD tenant to other Azure AD tenants. This activity can indicate an attacker attempting to maintain access or escalate privileges by leveraging existing user accounts to access resources in external tenants, or it could be a legitimate business-to-business (B2B) collaboration that needs to be approved.
This rule identifies modifications to the `/etc/ld.so.preload` file. This file is used by the Linux dynamic linker to specify shared libraries that should be loaded before any other libraries. Attackers can modify this file to inject malicious shared objects into processes, enabling privilege escalation, persistence, or defense evasion by loading arbitrary code.
Detects attempts to change the password of the Directory Services Restore Mode (DSRM) administrator account. This account is a local administrator account on Domain Controllers, and attackers may modify its password to establish persistence or elevate privileges.
Page 253 of 401