Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
A post-authentication vulnerability (CVE-2025-53786) in Microsoft Exchange hybrid-joined configurations.
The following analytic identifies unauthorized Active Directory replication requests initiated from non-domain controller locations. It leverages EventCode 4662 to detect when a computer account with replication permissions creates a handle to domainDNS, filtering out known domain controller IP addresses. This activity is significant as it may indicate a DCSync attack, where an attacker with privileged access can request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access to sensitive information and potential full domain compromise.
Detects specially crafted RAR archives that exploit the CVE-2025-8088 directory traversal vulnerability. This technique is used to drop files into the Windows Startup folder for persistence, as seen in campaigns by the RomCom threat actor.
This rule detects advanced memory exploitation techniques, including anomalous memory protection changes (non-executable to executable), writes to executable memory regions within the same process, large executable memory allocations followed by network activity, and potential format string exploit attempts in web logs. It aims to identify behaviors indicative of bypassing ASLR and DEP.
Detects MucorAgent, a multi-stage .NET backdoor used by the Curly COMrades threat actor. It uses COM hijacking for persistence and executes AES-encrypted PowerShell scripts.
This rule detects the creation of new Microsoft Power Automate flows that are configured to use connectors capable of exfiltrating data via email or collaboration platforms like Microsoft Teams. It specifically looks for flows created with connectors which could indicate an attempt to send sensitive information outside the organization.
Detects the ConfuserEx-protected .NET loader for DarkCloud Stealer. This loader decrypts and injects the final VB6 payload.
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
This detection identifies the use of two drivers, rwdrv.sys and hlpdrv.sys, which have been observed in Akira ransomware campaigns. The activity includes dropping these drivers, creating associated services, and disabling Windows Defender.
Detects the creation of files and services associated with malicious drivers (hlpdrv.sys, rwdrv.sys) used by Akira ransomware affiliates for defense evasion, as reported by GuidePoint Security. This rule specifically looks for the creation of these driver files and the associated service registrations in the Windows Registry.
This rule detects potential DLL sideloading attempts by monitoring the loading of specific DLLs (version.dll and rtworkq.dll) from non-standard Windows system directories. It specifically looks for these DLLs being loaded by 'icardagt.exe' or 'mfpmp.exe' processes outside of 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their malicious DLLs instead of the legitimate ones.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration).
The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
This rule detects PowerShell script blocks that attempt to bypass AMSI (Antimalware Scan Interface) by patching or manipulating memory related to AMSI. It specifically looks for the presence of keywords like 'VirtualProtect', 'GetProcAddress', 'InteropServices', 'AmsiScanBuffer', and references to 'amsi.dll' or 'clr.dll' within PowerShell operational logs (EventID 4104). This combination of keywords indicates an attempt to programmatically interfere with AMSI's ability to scan script content.
Detects the execution of eudcedit.exe, the Windows Private Character Editor, which may be abused to bypass User Account Control (UAC) and achieve privilege escalation. Threat actors can leverage this trusted, auto-elevating binary to execute malicious payloads without prompting the user, particularly when UAC settings are permissive.
ICEEVENT: MSVC x64 thunk/prologue patterns + distinctive 'Servcie' error strings
NTLM Relay Attempt
YARA-L
Detects NTLM successful network logons where the source and destination workstations are the same, excluding loopback addresses. This behavior can be indicative of NTLM relay attacks where an attacker relays authentication from a victim to the victim's own machine, or other forms of NTLM abuse.
The following analytic detects the creation of suspicious service files within the systemd directories on Linux platforms. It leverages logs containing file name, file path, and process GUID data from endpoints. This activity is significant for a SOC as it may indicate an adversary attempting to establish persistence on a compromised host. If confirmed malicious, this could lead to system compromise or data exfiltration, allowing attackers to maintain control over the system and execute further malicious activities.
Detects potential exploitation of Dell ControlVault vulnerabilities (dubbed 'ReVault') by monitoring for related service crashes or the abnormal loading of the `bcmbipdll.dll` module. An attacker with local access can exploit these vulnerabilities for privilege escalation or persistence.
Detects the usage of PowerDodder, a post-exploitation persistence tool that appends malicious commands to existing script files by hijacking their execution flow.
This query detects multiple behaviors associated with the ApolloShadow malware, used by the Secret Blizzard threat actor. It looks for the creation of a specific administrator account, installation of root certificates using certutil, modification of Firefox settings to trust new certificates, and changes to network profiles to relax firewall rules.
This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.
Page 286 of 401