Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
Detects the creation of Windows services used by the Silver Fox APT group to establish persistence for their loader and vulnerable driver. This activity is part of a campaign to deploy the ValleyRAT backdoor.
Detects a combination of suspicious activities often associated with the LummaC2 stealer. This includes querying the 'Run' registry key for reconnaissance and creating a scheduled task for persistence, often named "Update" and set to run on logon.
Credwiz util dropped by mshta for dll sideloading
Detects scenarios where an attacker modify the configuration of a service to trigger an action when the service is crashed.
Detects scenarios where an attacker modify the configuration of a service to trigger an action when the service is crashed.
Detects scenarios where an attacker enable the Eaphost component in order to perform a DLL sideloading attack.
Detects scenarios where an attacker abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.
Detects scenarios where an attacker remotely creates a scheduled task over named pipes to execute commands or elevate privileges.
Detects scenarios where an attacker abuse task scheduler capacities to execute commands or elevate privileges.
Detects scenarios where APT actors exploits Fortinet vulnerabilities to gain access into Windows infrastructure.
Detects scenarios where an attacker calls the stickey key and execute CMD.
Detects scenarios where an attacker exploits the PrintNightmare vulnerability and obtained a CMD shell.
Detects scenarios where an attacker creates a hidden local account. See also rule "User account creation disguised in a computer account".
Detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.
Detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.
Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance
Detects scenarios where a suspicious group membership is changed.
Detects scenarios where a suspicious group membership is changed.
Detects the s1ngularity malware attempting to add a shutdown command to shell configuration files (`.bashrc`, `.zshrc`) for persistence and system lockout.
Page 282 of 401