Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This detection identifies unsigned DLLs loaded through DLL side-loading where the DLL shares the same file path as the process that loaded it. This technique is observed in malware like DarkGate and PlugX. The rule monitors DLL loading events, verifies digital signatures, and flags unsigned DLLs. It specifically excludes DLLs loaded from standard Windows system directories and Program Files to reduce false positives. Detecting such suspicious DLLs is crucial in preventing privilege escalation and other security breaches.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time
Detects potential DLL sideloading of DLLs that are part of antivirus software such as McAfee, Symantec, Bitdefender, F-Secure, CyberArk, Avast, ESET, and Trend Micro. The rule identifies when specific DLLs associated with these security products are loaded from an unexpected or non-standard directory, indicating a possible attempt to hijack the execution flow.
This rule detects various activities associated with the InterLock Ransomware (UNC5774). It identifies anti-VM checks performed via PowerShell, specifically looking for commands that query for QEMU, memory less than 4GB or 1.5GB, or specific desktop naming conventions. It also detects local group and Service Principal Name (SPN) enumeration using PowerShell cmdlets like 'Get-LocalGroupMember', 'Get-LocalGroup', or ADSI queries for 'samAccountName' and 'servicePrincipalName'. Persistence mechanisms are covered by monitoring registry Run/RunOnce keys for entries that launch 'node' or 'php' executables. Furthermore, the rule looks for suspicious staging of 'node.exe' or 'php.exe' within the AppData\Roaming directory when initiated by PowerShell processes. The rule leverages 'DeviceProcessEvents', 'DeviceRegistryEvents', and 'DeviceEvents' (specifically PowerShellCommand action type) to capture these activities.
A DefenderXDR Custom Detection for CVE-2025-56383
Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. The rule filters out legitimate loads from common installation paths and specific applications like Eclipse.
Detects remote RPC calls to create or execute a scheduled task via ATSvc
Detects remote RPC calls to create or execute a scheduled task
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Detects the use of at/atd which are utilities that are used to schedule tasks.
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code
Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.
Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Detects scenarios where one can control another users or computers account without having to use their credentials.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Page 269 of 401