Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects anomalous process injection behavior characteristic of the Turb00 operation (e.g., Go-loader/HijackLoader variants). The rule identifies a two-stage signal: first, the mapping of an unbacked or unusually named executable image into a process before the loading of ntdll.dll; and second, the subsequent invocation of sensitive process manipulation APIs like CreateRemoteThread or SetThreadContext on the same host within a 10-minute window, consistent with process hollowing.
This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.
Detects indicators of Device Code Lab's PRT Refresh capability, where an administrator's 'Revoke all sessions' (revokeSignInSessions) action is followed by a prt-refresh backend call that reactivates the attacker's session without new user interaction, bypassing standard OAuth refresh token revocation.
Detects the privilege escalation sequence used by VILE ransomware, which involves manipulating process tokens via a combination of OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, GetTokenInformation, SetTokenInformation, and DuplicateTokenEx. This is followed by the termination of processes using TerminateProcess, typically performed to release locked files before encryption.
This rule detects the creation of specific hidden files ('.Maccy', '.lock', '.config') within the 'Library/Application Support/com.apple.finder.core/' directory on macOS. This behavior is indicative of potential persistence mechanisms, configuration tampering, or malicious activity related to the Finder application environment.
Detects instances where a process located outside of the standard '/System/' or '/usr/' directories loads the 'Security.framework' library. This behavior is suspicious as it may indicate an attempt by an untrusted or malicious binary to hook into or interact with system-level security services, such as keychain or cryptographic APIs.
Detects in-memory shellcode execution chains associated with BeepRAT and DcRAT. This includes the use of TCC (Tiny C Compiler) with specific flags for in-memory execution and LuaJIT FFI calls used to invoke Windows kernel functions (VirtualAlloc/CreateThread) for shellcode injection.
This rule detects the exploitation of CVE-2026-48558, a critical OIDC authentication bypass vulnerability in SimpleHelp. The detection logic correlates log events for 'Registering technician login' involving 'New Anon' sessions with subsequent configuration save requests occurring within 30 seconds. This pattern signifies the unauthorized creation of a privileged technician account by an unauthenticated attacker, bypassing standard identity verification.
Detects instances where wermgr.exe, typically used for Windows Error Reporting (WER), spawns interactive command-line interfaces such as cmd.exe, powershell.exe, or others. This behavior is indicative of exploitation (such as CVE-2026-50656) where an attacker has redirected a scheduled task to execute malicious code under SYSTEM integrity, masquerading as the wermgr.exe process.
Detects the creation of specific staging directories prefixed with 'RP_' in user temporary directories, containing 'System32' or 'wdtest_temp' subdirectories. This pattern is characteristic of an NTFS junction swap exploitation technique used to target Windows Defender quarantine artifact placement as part of the CVE-2026-50656 vulnerability.
Detects potential privilege escalation attempts targeting AnyDesk runtime via named pipe exploitation. The rule monitors for unauthorized cross-process access to AnyDesk processes, AnyDesk spawning suspicious child processes indicative of post-exploitation activity, and the execution of a known vulnerable AnyDesk binary version.
Detects high-risk administrative or user actions within Microsoft 365 environments that are frequently associated with adversary persistence, data exfiltration, and privilege escalation. The rule monitors for the creation or modification of inbox forwarding rules, addition of mailbox permissions, OAuth application consent grants, bulk mailbox searches, and programmatic access to mail items via EWS or Graph API.
Detects potential exploitation of RustDesk remote access software, focusing on unauthorized process execution from RustDesk-related binaries (including session relay and rendezvous components) and the presence of documented proof-of-concept (PoC) artifacts associated with session permission bypass vulnerabilities.
Detects the creation of shortcut (.lnk) files in the Windows Startup directory by common archive extraction utilities, indicative of the Gamaredon/UAC-0226 GIFTEDCROOK campaign using CVE-2025-8088 to perform path traversal and gain persistence.
This rule detects the creation of a new .sys driver file outside of standard Windows system directories (System32/drivers, DriverStore, SysWOW64/drivers) followed by the registration or modification of a service in the Windows Registry (CurrentControlSet/Services) within 15 minutes. This pattern is indicative of potential unauthorized driver installation or a Bring Your Own Vulnerable Driver (BYOVD) attack.
Detects Microsoft Entra ID (formerly Azure AD) sign-in logs where a single user account authenticates from two different countries within a 10-minute window, which is indicative of potential account compromise or credential sharing.
Detects when a user or service principal is assigned the 'Owner' or 'Contributor' role at the Subscription scope in Azure. This activity is often associated with privilege escalation and persistent access techniques.
This rule computes a composite risk score for user authentication events across multiple identity and network providers (Okta, Azure AD, VPNs, etc.). It flags suspicious patterns including impossible travel, credential stuffing indicators (multiple failures followed by success), new or unknown devices, and lateral movement attempts (concurrent access to both VPN and SSO services). Only users meeting a risk score threshold of 40 or higher with at least one successful authentication are reported.
This rule detects an unusually high volume (10 or more within an hour) of successful access control or role-related operations initiated by a single caller in Azure Activity logs. Such activity could indicate an adversary attempting to enumerate permissions, escalate privileges, or modify access to resources within an Azure environment.
Identifies the loader cementing persistence by creating a scheduled task that executes the RMM payload upon user logon or system start. Specifically looks for 'schtasks.exe' creating a task with a name that is not alphanumeric and a task run command pointing to an executable in the AppData directory.
Detects persistence mechanisms associated with the UAC-0226 threat actor by identifying a LNK shortcut file located in the user Startup folder that executes a minimized cmd.exe process. This command shell subsequently launches a hidden PowerShell command that reads and executes code from C:\ProgramData\WC3 using Invoke-Expression (IEX). This activity is linked to the GIFTEDCROOK delivery chain.
Page 26 of 401