Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects changes to the PSFactory COM InProcServer32 registry key, specifically targeting the CLSID {c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}. This technique has been observed being used by the RomCom threat actor to establish persistence by storing a malicious DLL, replacing the legitimate ActXPrxy.dll.
This rule detects potential persistence via Component Object Model (COM) hijacking by monitoring modifications to the Windows Registry. Specifically, it looks for changes where the 'InprocServer32\(Default)' key is set to 'C:\WINDOWS\system32\scrobj.dll'. Adversaries can abuse scrobj.dll, which looks for the 'ScriptletURL' key to execute scripts, to maintain persistence on a system.
Detects modifications to the 'TreatAs' registry key, which can be used for COM Hijacking. This technique allows an attacker to substitute a legitimate COM object with a malicious one, often used for persistence or privilege escalation, particularly when combined with commands like "rundll32.exe -sta". The rule includes filters for common legitimate processes that might modify this key, such as Microsoft Office components, svchost.exe, and msiexec.exe during installations or updates.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
The following analytic detects the creation or modification of hidden scheduled tasks on Windows systems, which are not visible in the UI. It leverages Windows Security EventCode 4698 to identify tasks where the 'Hidden' setting is enabled. This behavior is significant as it may indicate malware activity, such as Industroyer2, or the use of living-off-the-land binaries (LOLBINs) to download additional payloads. If confirmed malicious, this activity could allow attackers to execute code stealthily, maintain persistence, or further compromise the system by downloading additional malicious payloads.
This detection identifies when a user successfully authenticates from a country for the first time within a given period. It establishes a baseline of known countries for each user and alerts on any successful login originating from a country not present in that baseline. This behavior can indicate compromised credentials being used from an unusual location, or a legitimate user traveling to a new country.
Detects the execution of the 'sudo' command with the '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
This analytic identifies the modification of the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user. This detection leverages Azure AD audit logs, specifically monitoring the "Update user" operation and changes to the SourceAnchor attribute. This activity is significant as it is a step in setting up an Azure AD identity federation backdoor, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, leading to unauthorized access and potential data breaches.
This analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
This rule detects suspicious failed logon attempts by monitoring specific uncommon error codes. These error codes indicate issues such as logons to disabled accounts, attempts outside authorized hours, from unauthorized workstations, or due to trust relationship failures or insufficient logon rights. Such failures can suggest an adversary attempting to bypass security controls or test account validity and permissions.
This analytic detects the addition of a new federated domain within an Azure Active Directory tenant. It identifies successful "Set domain authentication" operations in Azure AD AuditLogs. This activity is significant as it may indicate the use of the Azure AD identity federation backdoor technique, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, potentially leading to unauthorized access and control over the Azure AD environment.
This analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It specifically detects EventID 20 (EventConsumer creation) from Sysmon logs. WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making them a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.
The following analytic detects the creation of SSH key files in the ~/.ssh/ directory. It leverages filesystem data to identify new files in this specific path. This activity is significant because threat actors often create SSH keys to gain persistent access and escalate privileges on a compromised host. If confirmed malicious, this could allow attackers to remotely access the machine using the OpenSSH daemon service, leading to potential unauthorized control and data exfiltration.
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.
This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. These files typically facilitate process hiding, credential theft, and backdoor access. Monitoring for such file creation patterns enables early detection of rootkit deployment before full compromise.
The following analytic identifies `services.exe` spawning a LOLBAS (Living Off the Land Binaries and Scripts) execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `services.exe` is the parent process. This activity is significant because adversaries often abuse the Service Control Manager to execute malicious code via native Windows binaries, facilitating lateral movement. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe security risk.
This analytic detects the creation of scheduled tasks on Windows systems where the command arguments include HTTP strings. This behavior is often indicative of malware activity or the use of Living off the Land binaries (LOLBins) to download additional payloads. Such activity, if malicious, could lead to data exfiltration, malware propagation, or unauthorized access.
The analytic detects the use of `GetProcAddress` within PowerShell script blocks, captured via PowerShell Script Block Logging (EventCode=4104). The presence of `GetProcAddress` in PowerShell is often indicative of malicious activity, such as process injection or other code execution techniques, as it allows for dynamic resolution of API functions. This behavior is unusual for legitimate PowerShell scripts and suggests an attacker is attempting to execute arbitrary code, potentially leading to system compromise. Analysts should investigate the full script block and any associated processes.
The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.
The following analytic detects the loading of DLL modules associated with the GraphicalProton backdoor implant, commonly used by SVR in targeted attacks. It leverages Sysmon EventCode 7 to identify specific DLLs loaded by processes. This activity is significant as it may indicate the presence of a sophisticated backdoor, warranting immediate investigation. If confirmed malicious, the attacker could gain persistent access to the compromised host, potentially leading to further exploitation and data exfiltration.
Page 264 of 401