Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects PowerShell commands that attempt to copy files into critical Windows system directories like "System32" or "SysWOW64". This activity can be indicative of persistence mechanisms, defense evasion, or credential access attempts, such as installing a malicious password filter DLL.
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware. The rule specifically looks for `wmic.exe` or `wmiprvse.exe` as a parent process, executing `reg.exe add` commands to modify `Run` registry keys, and targeting suspicious file paths commonly used by malware for persistence.
Detects file association changes using the built-in "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
Detects when the `assoc` command-line utility is used to change the default file association of any extension to an executable (`exefile`). This technique can be used by adversaries for persistence or privilege escalation by making a specific file type execute a malicious program when opened.
This rule detects suspicious modifications to screensaver settings in the Windows Registry using `reg.exe`. Adversaries may manipulate these settings to establish persistence by executing malicious content when a user is inactive. Specifically, it looks for `reg.exe` commands that modify the `ScreenSaveActive`, `ScreenSaveTimeout`, `ScreenSaverIsSecure`, or `SCRNSAVE.EXE` registry values within `HKEY_CURRENT_USER\Control Panel\Desktop` or `HKCU\Control Panel\Desktop` with the `/f` (force) flag.
This rule detects the execution of 'vmnat.exe' when its filename has been changed. Adversaries may rename legitimate executables to evade detection, especially when attempting DLL side-loading. The rule specifically looks for processes where the original filename is 'vmnat.exe' but the executed image file path does not end with 'vmnat.exe'. This behavior could indicate an attempt to leverage a legitimate, signed executable for malicious purposes, such as DLL side-loading, where a malicious DLL is placed in the same directory as the renamed legitimate executable.
Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.
This rule detects attempts by non-privileged users (IntegrityLevel: Medium or S-1-16-8192) to modify Windows service configurations in the registry. It specifically looks for command-line executions of 'reg' with 'add' or 'powershell' with 'set-itemproperty', 'sp', or 'new-itemproperty' that target service-related registry paths (containing 'ControlSet' and 'Services') and modify critical service parameters like 'ImagePath', 'FailureCommand', or 'ServiceDLL'. This activity could indicate an attempt to establish persistence or elevate privileges by hijacking service execution.
Detects the installation of a new shim database where the file is located in a non-default location. This can be an indicator of persistence or privilege escalation attempts using application shimming.
This rule detects modifications to the Winlogon Notify registry key to establish persistence. Adversaries may abuse Winlogon's features to execute DLLs when a user logs in. The rule specifically looks for changes to the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon` registry key where the `Details` field indicates a DLL file (`.dll`) is being set.
Detects execution of ChromeLoader malware via a registered scheduled task, specifically looking for PowerShell executing Chrome with a `--load-extension` argument pointing to a suspicious local path.
This rule detects changes to an application's Uniform Resource Identifier (URI) configuration within Azure. Such changes can include modifications to domain names, protocol usage (e.g., switching from HTTPS), the introduction of wildcards, or URIs pointing to uncontrolled domains. These types of modifications can be indicative of an attacker attempting to redirect traffic, establish persistence, or facilitate other malicious activities by altering how an application is accessed or interacts with external resources.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
Detects the creation of doas.conf file in linux host platform.
This rule detects the creation of 'WerFault.exe' or 'wer.dll' in directories other than the standard Windows system folders (C:\Windows\SoftwareDistribution\, C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This activity is highly suspicious and could indicate an attempt at DLL hijacking, specifically targeting the Windows Error Reporting process (WerFault) for privilege escalation, persistence, or defense evasion.
This rule detects attempts to establish persistence and elevate privileges by replacing the sticky keys executable (sethc.exe) with cmd.exe. This technique allows an attacker to gain a privileged command prompt on the Windows logon screen without authentication, typically by pressing the Shift key five times. The rule specifically looks for command-line arguments indicating the copying of cmd.exe to sethc.exe.
Detects the use of SettingSyncHost.exe to execute a hijacked binary. This technique leverages the legitimate Windows utility SettingSyncHost.exe, which is designed to synchronize settings across devices, to execute arbitrary commands. The rule specifically looks for instances where SettingSyncHost.exe's parent command line contains 'cmd.exe /c', 'RoamDiag.cmd', and '-outputpath', indicating an attempt to run a command-line interpreter to execute a script, while the image itself is not located in standard system directories, suggesting a hijacked execution.
Detects suspicious execution of rundll32.exe with command-line arguments that indicate the invocation of inline VBScript. This behavior has been observed in attacks attributed to UNC2452 (APT29/NOBELIUM), specifically using patterns like 'Execute', 'RegRead', and 'window.close' within the command line to execute malicious VBScript.
Detects the creation of a scheduled task using `schtasks.exe` that includes `curl` for downloading content and `powershell` for execution within the task's action. This combination is often used by adversaries to establish persistence, download malicious payloads, and execute them without directly dropping malware on the host, facilitating command and control.
Detects the creation of scheduled tasks using 'schtasks.exe' where the task's executable path points to suspicious folders or uses environment variables commonly abused by malware for persistence or privilege escalation. This rule specifically looks for tasks created in locations like 'Perflogs', 'Users\All Users', 'Users\Default', 'Users\Public', 'Windows\Temp', 'AppData\Local', 'AppData\Roaming', or using '%AppData%' and '%Public%' environment variables.
This rule detects attempts to add users to highly privileged groups on Windows systems. It specifically looks for command-line executions of 'net localgroup <groupname> /add' or 'Add-LocalGroupMember -Group <groupname>' where the group name is either 'Group Policy Creator Owners' or 'Schema Admins'. These groups are considered highly privileged, and unauthorized additions could indicate privilege escalation or persistence.
Page 257 of 401