Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the loading of the kernel driver associated with the Process Hacker tool. This tool, while legitimate, can be used by adversaries for various malicious activities, including bypassing security controls, inspecting processes, and potentially escalating privileges. The rule identifies the driver by its filename and specific import hashes.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. This rule detects the creation of new custom shim database files in the default Windows shim database directories, which can indicate an attempt to abuse the Application Compatibility Infrastructure for malicious purposes.
Detects the loading of .NET Common Language Runtime (CLR) DLLs by scripting applications such as wscript, cscript, or mshta. This behavior can indicate suspicious execution, potentially involving techniques like DotNetToJScript or Donut, which use scripting hosts to execute .NET assemblies in memory. The rule specifically looks for `clr.dll`, `mscoree.dll`, or `mscorlib.dll` being loaded by a predefined list of scripting or utility executables.
Detection of unusual child processes (PowerShell or Command Prompt) spawned by critical system processes (winlogon.exe, services.exe, lsass.exe, csrss.exe, smss.exe, wininit.exe, spoolsv.exe, searchindexer.exe) running under an authorized user context. This behavior can indicate privilege escalation or defense evasion, especially if the spawned process is not related to legitimate network routing commands.
This rule detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Specifically, it looks for the creation of a process where the parent process is 'mmc.exe' and its command line contains 'WF.msc', while filtering out legitimate 'WerFault.exe' processes.
This rule detects a specific UAC bypass method known as 'TrustedPath UAC Bypass'. This technique involves creating specially crafted directories that mimic legitimate Windows system paths (e.g., 'C:\Windows \System32\') to trick the operating system into executing an untrusted application with elevated privileges without a UAC prompt. The detection logic specifically looks for process creation events where the image path contains these malformed system directory names.
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. This rule detects the modification of registry keys under 'Control\Print\Monitors\' where a DLL is specified, indicating the potential for port monitor persistence.
Detects modifications to specific registry keys under 'Software\Policies\Microsoft\Windows\System\Scripts' related to system startup, shutdown, logon, and logoff scripts. These modifications can be used to establish persistence or escalate privileges by executing malicious code at various system events.
Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. This might be used as a method of persistence. The entries found under App Paths are used primarily to map an application's executable file name to that file's fully qualified path and to prepend information to the PATH environment variable on a per-application, per-process basis.
This rule detects the creation of a service named 'WerFaultSvc' with EventID 7045 from the 'Service Control Manager' provider, which is associated with the Turla PNG dropper as reported by NCC Group in November 2018. This indicates potential persistence or privilege escalation by the Turla APT group.
Detects the deactivation and disabling of the Scheduled defragmentation task using 'schtasks.exe /delete' or 'schtasks.exe /change' commands, specifically targeting the '\Microsoft\Windows\Defrag\ScheduledDefrag' task. This activity has been observed in campaigns by the Slingshot APT group.
Detects the sideloading of specific trojanized DLLs by legitimate Windows executables, a technique observed in Lazarus APT campaigns targeting a Spanish aerospace company. The rule identifies suspicious DLL loads by monitoring 'ImageLoaded' events for particular DLLs being loaded by specific executables from unusual paths, indicating potential DLL hijacking or sideloading for persistence, privilege escalation, or defense evasion.
Detects changes to the "Winlogon" registry key where a process sets the "Shell" value to a string containing specific PowerShell commands observed in KamiKakaBot samples. This technique is used to achieve persistence by executing a malicious script during user logon.
Detects failed sign-in attempts for privileged roles where the user does not meet expected security controls, such as signing in from an unapproved country, IP address, or device. This rule helps identify potential unauthorized access attempts to administrative accounts.
Detects when a user is added to a privileged role in Azure AD. This could indicate an attempt to escalate privileges or establish persistence within the cloud environment.
Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.
This rule identifies an event where the number of accounts assigned the Global Administrator role in Azure Active Directory (now Microsoft Entra ID) exceeds a predefined threshold. This is detected by monitoring the 'tooManyGlobalAdminsAssignedToTenantAlertIncident' risk event type from Azure PIM (Privileged Identity Management). A high number of Global Administrators can increase the attack surface and risk of privilege abuse or compromise.
Detects when user access has been blocked by Azure Conditional Access policies. This indicates that token issuance was denied, which could be a sign of unauthorized login attempts to valid accounts.
Detects when a user successfully logs on to sanctioned applications from an IP address identified as risky by Microsoft Cloud App Security. This indicates a potential compromise of the user's account or an attempt to access resources from an unusual and potentially malicious location.
This rule detects the creation or modification of the `/etc/ld.so.preload` file. This file is used by the dynamic linker (`ld.so`) on Linux systems to specify shared libraries that should be loaded before any other libraries. Adversaries can leverage this mechanism for persistence, privilege escalation, or defense evasion by preloading malicious libraries, effectively hijacking legitimate functions. Refer to `man ld.so` for more details on its functionality.
Detects attempts to load images or drivers that violate Windows Code Integrity policies, indicating a potential bypass attempt or the execution of unsigned/malicious code. This event signifies that the system blocked the load due to unmet authenticode signing level requirements or a policy violation.
Page 255 of 401