Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of a scheduled task named "MicrosoftsUpdate" which is used to execute a malicious batch file as part of the HrServ web shell infection chain.
Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects potential DLL sideloading of "dbghelp.dll" by identifying instances where this DLL is loaded from a non-standard or unexpected directory. This technique can be used by adversaries for defense evasion, persistence, or privilege escalation.
Detects probable exploitation of the reported Notepad++ plugin DLL hijack by correlating DLL loads from Notepad++\plugins with recent file changes or swap-style renames, prioritising user-writable locations (Users/AppData/OneDrive) and weak trust. Outputs a Verdict and SuspicionScore for quick triage.
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
This rule detects the creation of processes where the command line or image path explicitly references the 'Sysnative' folder (e.g., 'C:\Windows\Sysnative\'). This behavior is often observed in malware, particularly Cobalt Strike, to bypass WoW64 file system redirection and execute 64-bit binaries from a 32-bit process. The rule includes filters to reduce false positives from legitimate applications like .NET's ngen.exe and XAMPP's use of cmd.exe within Sysnative.
Detects the creation of a new kernel driver service using 'sc.exe'. This activity can be indicative of persistence or privilege escalation attempts by adversaries, as kernel drivers operate with high privileges. The rule specifically looks for 'sc.exe' commands that include 'create' or 'config' along with 'binPath', 'type', and 'kernel' parameters. It includes filters for known legitimate Avira driver installations to reduce false positives.
Detects a sequence of commands associated with UAT-8099 activity, where a new user (including hidden or test accounts) is created or the guest account is enabled, and then added to the Administrators and Remote Desktop Users groups. This pattern is used for establishing persistence and remote access.
Detects potential DLL side-loading activity associated with the Confucius threat group. This rule identifies when a legitimate executable, known to be abused by Confucius (e.g., fixmapi.exe), is run from a non-standard, user-writable directory and loads a suspicious DLL from the same location.
Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Attackers may use this technique to evade detection and execute commands in a modified environment.
This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463.
While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.
Detects the loading of a malicious 'pc2msupp.dll' via legitimate applications, a technique used by Naikon and BackdoorDiplomacy groups to load RainyDay, Turian, and a new PlugX variant.
Detects the creation of suspicious script files (.vbs, .js, .ps1, .bat, .cmd) in the Windows Startup folder. This is a common persistence technique used by malware, including XWorm, to ensure execution upon user logon.
Detects the FlipSwitch Proof-of-Concept (PoC) Linux rootkit. This rootkit is designed to bypass modern Linux kernel (v6.9+) defenses by patching call instructions within the x64_sys_call function, a technique dubbed 'FlipSwitch'.
Detects the creation of a scheduled task by a process named 'lsassa.exe', a .NET backdoor used by Lunar Spider. The malware masquerades as the legitimate 'lsass.exe' process and establishes persistence by creating a task that runs on startup.
This rule detects instances of 'WerFaultSecure.exe' being spawned by an unusual or unexpected parent process. 'WerFaultSecure.exe' is a legitimate Windows component responsible for error reporting and crash dumping. Adversaries may abuse this process, particularly for memory dumping (e.g., LSASS dumping) to evade defenses and escalate privileges. The rule identifies parent processes that are not part of a predefined list of legitimate parents (wermgr.exe, svchost.exe, csrss.exe, WerFault.exe). It assigns a suspicion score and risk level based on the initiating process's filename (e.g., PowerShell, CMD, Explorer) and folder path (e.g., Temp, AppData, Users). It also extracts the target Process ID (PID) and dump type from the command line, and checks for suspicious parameters, to provide a comprehensive risk assessment.
NOTE: Big kudos to "Steven Lim @KQLWizard" as he developed the detection and i just adapted the extract regex. at my tests -p was not enough as the parameter was /pid is used.
Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day.
Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified.
-- original description from @KQLWizard --
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day.
Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified.
-- original description from @KQLWizard --
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
Page 273 of 401