Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the DLL sideloading of malicious DLLs (ffmpeg.dll, libvlc.dll) by legitimate applications (Element.exe, VLC.exe) as observed in the 'Illusory Wishes' campaign.
The following analytic detects instances where a Duo admin login originates from a country outside of the United States, which may indicate suspicious or unauthorized access attempts. It works by analyzing Duo activity logs for admin login actions and filtering out events where the access device's country is not within the expected region. By correlating user, device, browser, and location details, the analytic highlights anomalies in geographic login patterns. This behavior is critical for a SOC to identify because admin accounts have elevated privileges, and access from unusual countries can be a strong indicator of credential compromise, account takeover, or targeted attacks. Early detection of such activity enables rapid investigation and response, reducing the risk of unauthorized changes, data breaches, or further lateral movement within the environment. The impact of this attack can be severe, potentially allowing attackers to bypass security controls, alter configurations, or exfiltrate sensitive information.
Identifies unsigned processes creating scheduled tasks, a common persistence mechanism for malware. **Validation**: Very High - Legitimate task creation is typically done by signed system utilities.
Detects process injection into ImagingDevices.exe, a technique observed in the 'Illusory Wishes' campaign to evade detection. The threat actor used trojanized versions of Element and VLC to inject shellcode into this legitimate Windows process.
Detects techniques used by the Dropping Elephant APT group to stage and execute a DLL side-loading attack using VLC Media Player. This includes the execution of VLC from suspicious paths, the use of PowerShell to download and rename payloads into those paths, and the specific scheduled task used for persistence.
Detects the creation of a new HKEY_CLASSES_ROOT (HKCR) shell open command entry that points to an executable in a temporary directory. This persistence technique is used by Warlock Dark Army ransomware.
This rule detects HTTP POST requests to specific SharePoint application paths, including ToolPane.aspx and SignOut.aspx. These paths have historically been associated with SharePoint vulnerabilities, particularly unauthenticated remote code execution (RCE) exploits. The rule aims to identify attempts to interact with these sensitive endpoints, which could indicate an attacker attempting to exploit known vulnerabilities or perform unauthorized actions.
This rule detects suspicious device registration activity in Azure Active Directory (now Entra ID). Specifically, it looks for a sequence of two events: first, a 'Device Registration Service' adding a device with 'CloudAccountEnabled' set to true and a specific Windows build number (10.0.19041.928) in the user agent, followed by an attempt to add registered users to the device, referencing 'urn:ms-drs:enterpriseregistration.windows.net'. This sequence could indicate an adversary attempting to register a new device to bypass conditional access policies or gain persistent access.
Detects potential exploitation of Microsoft Entra ID (formerly Azure AD) by attackers who abuse app role permissions to backdoor federated domains and escalate to Global Administrator using forged SAML tokens
The analytic identifies instances where a Duo admin logs in using a browser other than Chrome, which is considered unusual based on typical access patterns. This behavior is significant for a SOC because the use of an unexpected browser may indicate credential compromise, session hijacking, or the use of unauthorized devices by attackers attempting to evade detection. Detecting such anomalies enables early investigation and response, helping to prevent privilege escalation, policy manipulation, or further compromise of sensitive administrative accounts. The impact of this attack could include unauthorized changes to security policies, user access, or the disabling of critical security controls, posing a substantial risk to the organizations security posture.
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
Detects the creation of `spinstall0.aspx`, a known indicator of successful post-exploitation of the SharePoint vulnerability CVE-2025-53770.
The following analytic detects when a Duo policy is created or updated to allow the use of outdated Java versions, which can introduce significant security risks. It works by searching Duo administrator activity logs for policy creation or update actions where the policy explicitly sets 'java_remediation' to 'no remediation', indicating that no restrictions are enforced against old Java. The analytic aggregates relevant details such as the user, admin email, and action context for further investigation. Identifying this behavior is critical for a Security Operations Center (SOC) because allowing outdated Java can expose an organization to known vulnerabilities, malware, and exploitation techniques. Attackers or malicious insiders may attempt to weaken security controls by modifying policies to permit insecure software, increasing the risk of compromise. Prompt detection enables SOC analysts to respond quickly, revert risky changes, and mitigate potential threats before they are exploited.
This detection identifies when the legitimate application DingTalk.exe loads a DLL from a non-standard file path. This behavior is associated with the SLOW#TEMPEST campaign, which uses this DLL sideloading technique to execute its malicious payload.
This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.
This rule detects attempts to modify the local Administrators group using the 'net localgroup administrators' command. This command is often used by adversaries to add users to the local administrators group for privilege escalation or persistence.
Looking for strings entered into and executed from the Windows run box, which is leveraged by ClickFix campaigns for initial access.
Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
This rule detects suspicious execution of MSBuild.exe from non-standard user-writable temporary or roaming directories. Adversaries often abuse MSBuild.exe, a legitimate Microsoft utility, to proxy execution of malicious code, bypassing application control defenses. The rule specifically looks for MSBuild.exe running from common temporary or user-controlled paths like AppData\Local\Temp, AppData\Roaming, C:\Temp, or C:\Users\Public, which is indicative of potential malicious activity such as process injection or execution of infostealers like Lumma Stealer.
Actions:
Review the parent process (InitiatingProcess*) for suspicious names and command lines.
Correlate with other indicators such as network connections, file writes, or registry changes.
Investigate the dropped files or payloads around the execution timestamp.
Actions:
Review the parent process (InitiatingProcess*) for suspicious names and command lines.
Correlate with other indicators such as network connections, file writes, or registry changes.
Investigate the dropped files or payloads around the execution timestamp.
This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. This activity may indicate unauthorized access, indicator removal, or persistence attempts by an attacker seeking to establish or maintain control of the host.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
Detects a non-interactive sign-in using a refresh token for the Microsoft Authentication Broker client, targeting the Device Registration Service (DRS) with the 'adrs_access' scope. This specific combination of attributes is highly indicative of an adversary using tools like ROADtools to register a malicious device in the tenant following a successful OAuth phishing attack.
Page 288 of 401