Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects potential persistence mechanisms on Windows systems by monitoring for the creation or modification of registry run keys, the use of 'reg.exe' to add entries to run keys, and the creation of shortcut files (.lnk) in the Windows Startup directory.
Detects the modification of the EnableLUA registry key via the reg.exe utility. Setting EnableLUA to 0 effectively disables Windows User Account Control (UAC), which is a common post-exploitation technique used to elevate privileges or bypass security prompts.
Detects specific persistence artifacts associated with LARP53RAT, including unauthorized file shortcuts in the Startup folder, modifications to RunOnce registry keys for system recovery, and suspicious scheduled task creation masquerading as Microsoft Edge updates.
Detects the execution of 'net.exe' from a 'powershell.exe' parent process to either reset the local administrator password or reactivate a built-in domain administrator account. This behavior is associated with the Akira ransomware group's pre-encryption stage to ensure access to compromised endpoints.
Detects indicators of the DirtyClone (CVE-2026-43503) Linux kernel local privilege escalation exploit. The rule identifies the execution or compilation of the PoC binary, the specific su invocation used for shell spawning by the exploit, and subsequent post-exploitation actions including modifying sensitive files (/etc/passwd, /etc/sudoers) and creating new local accounts with sudo privileges.
This rule detects the execution of processes named 'RoguePlanet.exe' and monitors for inter-process communication using named pipes with the same name. This pattern is indicative of a specific malware payload attempting to establish communication channels for C2 or process interaction.
Detects Microsoft 365 sign-in patterns indicative of an adversary bypassing Conditional Access device compliance requirements using an edge appliance proxy. The rule identifies successful authentication sessions from non-compliant or unmanaged devices that satisfy Conditional Access, often involving impossible travel or multiple source IPs, suggesting the use of an intermediary infrastructure to masquerade as a trusted location.
Detects opportunistic lock (oplock) placement on wermgr.exe alternative data streams or volume shadow copy paths. This behavior is associated with the RoguePlanet exploit chain, which attempts to pause the Microsoft Defender service (MsMpEng.exe) by creating a Time-of-Check to Time-of-Use (TOCTOU) race condition during the quarantine process.
Detects execution of wermgr.exe from suspicious, non-standard directories (such as temp or user-writable paths). This behavior is indicative of the 'RoguePlanet' exploit, which leverages a junction swap to replace the legitimate Windows Error Reporting binary with a malicious payload, executed via the WER QueueReporting scheduled task.
Detects potential supply-chain attack activity related to IronWorm, including modifications to the AppInit_DLLs registry key and the execution of Windows utility binaries (regsvcs.exe, regasm.exe, InstallUtil.exe) by npm or node processes, which are commonly abused to facilitate malicious code execution during package installation.
Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by correlating computer account password changes (Event ID 4742) with preceding anonymous or null SID logons (Event ID 4624) where the host identifier aligns. The rule identifies anomalous account modifications that occur within a short time window following an anonymous authentication request on the same host.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
This rule detects suspicious activity related to the assignment of application roles. Specifically, it identifies when a single user principal name (UPN) performs 10 or more successful 'Add app role assignment' operations within a one-hour window. This could indicate an attacker rapidly granting themselves or other entities access to multiple applications or resources.
This rule detects command-line activity and process execution associated with the exploitation of various Linux kernel vulnerabilities, including CVE-2026-43503, CVE-2026-46300, CVE-2026-43284, CVE-2026-31431, and CVE-2026-43500. It monitors for the compilation and execution of exploit code, manipulation of kernel modules via modprobe for specific network protocols (esp4, esp6, rxrpc), configuration changes to network namespaces (xfrm, unshare), and the presence of known exploit filenames like DirtyClone or DirtyFrag.
Detects suspicious command-line patterns on Linux systems commonly associated with post-exploitation activity, including the establishment of reverse shells, encoded payload delivery via DNS, and manual modifications to crontab or SSH authorized_keys for persistence.
This rule detects the use of 'sc.exe' to interact with services related to 'Mixed Reality' (a potential name masquerading technique) where the parent process is not the standard 'services.exe' or 'svchost.exe'. The rule also correlates this activity with the invocation of command interpreters like 'cmd.exe' or 'conhost.exe' by the parent process, which is highly indicative of malicious service manipulation or lateral movement.
Detects the injection of code into an svchost.exe process from a non-system directory, followed by the loading of .NET CLR runtime modules (clr.dll, clrjit.dll, or mscorlib.ni.dll) within 5 minutes. This pattern often indicates an attempt to execute managed code inside a legitimate system process, potentially to evade security controls. The rule further enriches the finding by identifying if the svchost.exe process is running in a non-standard service group, which serves as a high-confidence signal of anomalous behavior.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
Detects the creation of Windows scheduled tasks using 'schtasks.exe' where the executable being registered or the task itself is associated with suspicious directories like %LOCALAPPDATA%, %APPDATA%, or %TEMP%. The rule further filters for specific suspicious strings often used in malicious task configurations, indicating potential persistence or malicious command execution.
Detects unauthorized execution of AWS CLI commands within a shell spawned by Amazon Q or AWS language server processes. This activity typically involves the 'aws sts get-caller-identity' command being piped to 'curl' for remote exfiltration of cloud credentials, a behavior associated with the exploitation of CVE-2026-12957 in MCP auto-execution.
Detects the loading of known vulnerable drivers (e.g., ProcessMonitorDriver.sys, inpoutx64.sys) associated with 'The Gentlemen' RaaS group, used in BYOVD attacks to elevate privileges and terminate security products.
Page 28 of 401