Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects suspicious processes attempting to log on with explicit credentials (Event ID 4648). This rule specifically targets common command-line utilities like cmd.exe, powershell.exe, wmic.exe, net.exe, and reg.exe when they are used to explicitly log on, while filtering out localhost connections and service accounts (users ending with '$') to reduce false positives. This behavior can indicate an adversary attempting to escalate privileges or move laterally using compromised credentials.
Detects the creation of a Windows service named 'KrbSCM' which is associated with the KrbRelayUp tool. This tool is used for privilege escalation in Windows domain environments where LDAP signing is not enforced, leveraging Kerberos relay attacks.
This rule detects the creation of specific named pipes ('\imposecost' or '\imposingcost') which are known to be used by the 'Koh' tool. The 'Koh' tool is associated with credential access and privilege escalation techniques, often involving token impersonation or theft. Detection relies on Sysmon Event ID 17 or 18, which logs named pipe creation.
Detects the creation of an interactive AT job, which can be used for privilege escalation or persistence. The rule specifically looks for the execution of 'at.exe' with the 'interactive' command-line argument.
This rule detects modifications to the AppInit_DLLs registry key, which can be used by adversaries to establish persistence or elevate privileges. DLLs specified in this key are loaded by user32.dll into nearly every process that loads user32.dll. The rule specifically looks for changes to the 'AppInit_Dlls' value within the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows' and 'HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows' registry paths, excluding empty values.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
This rule detects the creation of specific Windows services ('srservice', 'ipvpn', 'hkmsvc') that have been identified as malicious by ESET in their 'Carbon Paper - Turla' report. These services are associated with the Turla APT group's second-stage backdoor, indicating potential privilege escalation and persistence mechanisms.
Detects the creation of specific Windows services ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in their March 2018 report. This rule monitors EventID 7045 from the 'Service Control Manager' provider.
This rule detects exploitation attempts of the privilege escalation vulnerability CVE-2019-1378. The vulnerability involves the Windows 10 Update Assistant (WUA) executing `SetupComplete.cmd` or `PartnerSetupComplete.cmd` with elevated privileges. An attacker can place a malicious script in `C:\Windows\Setup\Scripts\` which will then be executed by `cmd.exe` during the update process, leading to privilege escalation. The rule specifically looks for `cmd.exe` being the parent process, executing a command line that contains `C:\Windows\Setup\Scripts\` and ends with either `SetupComplete.cmd` or `PartnerSetupComplete.cmd`, while filtering out legitimate system processes that might also execute commands from these directories.
Detects the loading of 'oci.dll' by 'msdtc.exe', which is indicative of the Pingback backdoor. This backdoor is known to establish an ICMP tunnel for command and control communication.
Detects potential sideloading of malicious "aclui.dll" by OleView. This behavior was observed in Raspberry-Robin variants reported by Checkpoint Research in February 2024. The rule specifically looks for OleView.exe loading aclui.dll, while filtering out known legitimate paths and signed executables to reduce false positives.
Detects the setting of a DLL that handles a custom protocol handler, specifically targeting a CLSID observed in attacks attributed to Forest Blizzard APT. This technique can be used for persistence or privilege escalation by registering a malicious DLL to be loaded when a specific protocol is invoked.
Detects the creation of an Inline IAM policy by the 'S3 Browser' utility, where the policy still contains the default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>" instead of a specific bucket name. This indicates a potential misconfiguration or an attempt to create a broad policy that might be further exploited.
This rule detects successful user authentications originating from geographic locations (countries) that are not designated as operational areas for the organization. This helps identify potential unauthorized access attempts or compromised accounts being used from unexpected locations.
This rule detects sign-in failures in Azure Active Directory (now Microsoft Entra ID) that are specifically due to Conditional Access policies not being met. It identifies attempts where a user or service tried to authenticate but was blocked because the Conditional Access requirements were not satisfied. This could indicate an attacker attempting to bypass security controls, or legitimate users/services failing to meet policy requirements.
Detects a DNS server error indicating that a specified plugin DLL, configured in the registry, could not be loaded. This event can be triggered by an attacker attempting to load a malicious DLL for privilege escalation or persistence on a DNS server, often associated with techniques like DNSAdmin to DC compromise.
Detects when the 'SeEnableDelegationPrivilege' user right is assigned in Active Directory. This privilege allows a user to control other Active Directory user objects, which can be abused for privilege escalation and persistence within a domain.
This rule detects the creation of a new trust relationship to a domain, indicated by Windows Event ID 4706. The addition of domain trusts is an infrequent administrative action and should be carefully verified for legitimacy, as unauthorized trust relationships could be used for privilege escalation or persistence within an Active Directory environment.
Detects when the Code Integrity (CI) engine blocks a process from loading an unsigned DLL that resides in a suspicious location. This often indicates an attempt to bypass security controls or execute malicious code through DLL hijacking or side-loading.
Detects the creation of a Windows service by the ProcessHacker tool, specifically when the service is configured to run with 'LocalSystem' privileges and its name starts with 'ProcessHacker'. This indicates a potential privilege escalation attempt using ProcessHacker.
Detects potential remote thread creation with specific start addresses often associated with Cobalt Strike beacons, indicating process injection activity.
Page 254 of 401