Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of Sysinternals PsService, a utility that can be used for service reconnaissance, management, and potential tampering. This tool can be leveraged by adversaries for discovery, privilege escalation, or persistence by interacting with Windows services.
Detects uncommon child processes spawned by "userinit.exe". Legitimate child processes of userinit.exe typically include explorer.exe, logon scripts (like netlogon.bat, UsrLogon.cmd), PowerShell.exe on Windows Core, and specific Citrix or proquota.exe processes. The rule aims to identify suspicious or malicious executables launched by userinit.exe, which could indicate persistence mechanisms or privilege escalation attempts.
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration. This action can be used by adversaries to maintain persistence on a compromised account by preventing its password from expiring, thus avoiding the need to frequently update credentials.
This rule detects the creation or modification of a Windows service where the service binary's path is located in a suspicious directory. Adversaries often place malicious service executables in non-standard or temporary locations to evade detection and establish persistence. The rule specifically looks for service image paths containing '\Users\Public\', '\Perflogs\', '\ADMIN$\' or '\Temp\'.
Detects the installation of a DNS plugin DLL by monitoring modifications to the 'ServerLevelPluginDll' registry parameter. This technique can be used by adversaries to execute arbitrary code within the context of the DNS server, often requiring a restart of the DNS service to take effect. This can lead to privilege escalation and persistence on a compromised system.
Detects potential COM object hijacking by monitoring modifications to the default values of InprocServer32 or LocalServer32 subkeys within specific CLSIDs in the Windows Registry. The rule specifically looks for these modifications occurring in suspicious file system locations commonly used by adversaries for persistence or staging.
KQL Query from file: 7-Zip CVE-2025-11002 Detection
Detects potential DLL side-loading used by the AdaptixC2 framework, where a malicious DLL is dropped into the C:\Windows\Tasks directory, followed by the execution of a copied msdtc.exe from the same location.
This rule detects potential DLL sideloading of 'EACore.dll'. It specifically looks for instances where 'EACore.dll' is loaded by an executable, but the executable or the loaded DLL is not from the legitimate 'C:\Program Files\Electronic Arts\EA Desktop\EACoreServer.exe' path. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation by tricking legitimate applications into loading malicious DLLs.
Detects potential DLL sideloading of "mfdetours.dll" when loaded by a process other than the legitimate "mftrace.exe" from its expected path. This technique can be abused to force load a malicious DLL named "mfdetours.dll" from the current directory of execution, allowing for persistence, privilege escalation, or defense evasion.
This rule detects attempts to exploit a DLL search order hijacking vulnerability in the Windows Fax service. Specifically, it looks for instances where the 'fxssvc.exe' process attempts to load 'ualapi.dll' from a location other than the legitimate Windows system directories (e.g., 'C:\Windows\WinSxS\'). This indicates that an attacker may have placed a malicious 'ualapi.dll' in a directory that the Fax service searches before the legitimate system path, leading to the execution of the attacker's code.
Detects the loading of 'glib-2.0.dll' by the 'VMwareXferlogs.exe' utility from a directory other than the default VMware installation path. This behavior is indicative of potential DLL sideloading, where an attacker might place a malicious DLL in a non-standard location to be loaded by a legitimate application, often for privilege escalation, persistence, or defense evasion.
Detects the loading and execution of an unsigned Thor scanner binary. This rule specifically looks for 'thor.exe' or 'thor64.exe' being loaded, and then filters out instances where the binary is legitimately signed by 'Nextron Systems GmbH' with a valid signature status. This helps identify potentially malicious or unauthorized versions of the Thor scanner.
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
This rule detects process injection activities originating from Microsoft Word (winword.exe) that are characteristic of a LittleCorporal generated malicious document. Specifically, it looks for winword.exe as the source image performing process access, combined with a call trace that includes a .NET Framework 64-bit v2.x path and an 'UNKNOWN' module, which is indicative of injected code.
Detects the execution of the VMware Xfer utility (VMwareXferlogs.exe) from a directory other than its default installation path. This behavior is indicative of an attempt to sideload arbitrary DLLs, often used by adversaries for privilege escalation, persistence, or defense evasion. The rule specifically looks for instances where 'VMwareXferlogs.exe' is executed from a location not starting with 'C:\Program Files\VMware\'.
This rule detects the use of the 'reg.exe' command-line tool to add entries to specific Windows Registry Run keys. These Run keys are commonly used by adversaries to establish persistence, ensuring that a malicious program executes automatically when a user logs in. The rule specifically looks for 'reg.exe' being executed with 'add' command and targeting 'Software\Microsoft\Windows\CurrentVersion\Run', 'Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run', or 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run' registry paths.
Detects when 'regedit.exe' is launched with elevated privileges by either 'TrustedInstaller.exe' or 'ProcessHacker.exe'. This activity is highly suspicious as it indicates an attempt to modify the registry with system-level permissions, potentially for defense evasion or privilege escalation.
Detects attempts to modify critical service configuration registry keys (ImagePath, FailureCommand, and ServiceDll) by processes running with a 'Medium' integrity level. This activity can indicate a privilege escalation attempt where an attacker with medium integrity tries to alter service execution to gain higher privileges or establish persistence.
This rule detects when 'sdclt.exe' (System Data Collector) spawns any child processes. This behavior is often associated with User Account Control (UAC) bypass techniques, where sdclt.exe is leveraged to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule is a general indicator of such activity.
Detects the execution of Sysinternals PsSuspend, a utility that can be used to suspend running processes. This tool can be abused by adversaries to halt critical security processes or other applications, potentially for evasion or to facilitate further malicious activity.
Page 260 of 401