Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the successful registration of a new FIDO2/WebAuthn security key for a user account. This activity can be legitimate, but attackers who have compromised an account may register their own FIDO key to maintain persistent access. This activity should be correlated with other suspicious events, such as a recent password reset or login from an unusual location.
The analytic detects the creation of a new scheduled task with the highest execution privileges via Schtasks.exe. It leverages Endpoint Detection and Response (EDR) logs to monitor for specific command-line parameters ('/rl' and 'highest') in schtasks.exe executions. This activity is significant as it is commonly used in AsyncRAT attacks for persistence and privilege escalation. If confirmed malicious, this could allow an attacker to maintain persistent access and execute tasks with elevated privileges, potentially leading to unauthorized system access and data breaches.
The following analytic detects the execution of the runas.exe process with administrator user options. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as it may indicate an attempt to gain elevated privileges, a common tactic in privilege escalation and lateral movement. If confirmed malicious, this could allow an attacker to execute commands with higher privileges, potentially leading to unauthorized access, data exfiltration, or further compromise of the target host.
This detection identifies instances where the ESXi UI is accessed using the root account from an external IP address. Direct root access to the UI bypasses role-based access controls and auditing practices, and may indicate risky behavior, misconfiguration, or unauthorized activity by a malicious actor using compromised credentials.
Detects Microsoft Entra ID sign-in events where a user principal authenticates using a refresh token issued to the Microsoft Authentication Broker (MAB) client, targeting the Device Registration Service (DRS) with the "adrs_access" OAuth scope. This pattern may indicate token-based access to DRS following an initial authorization code phishing or as a precursor to malicious device registration using tools like ROADtx.
This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
Detects TTPs associated with the HazyBeacon backdoor, used by the threat cluster CL-STA-1020. This rule identifies the creation of a specific persistence service and the execution of custom exfiltration tools from the C:\ProgramData directory. This threat also uses C2 communication via AWS Lambda URLs (e.g., *.lambda-url.*.on.aws) from the mscorsvw.exe process, which should be monitored via network logs.
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
Detects the creation of hidden configuration files or a LaunchDaemon plist file used by the Odyssey Stealer malware to establish persistence on a compromised macOS system.
Detects Matanbuchus malware loader IOCs including file hashes, a scheduled task name, domains, and an IP address.
The analytic detects the use of 'schtasks.exe' to create a scheduled task on a remote system, indicating potential lateral movement or remote code execution. It leverages process data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line arguments and flags. This activity is significant as it may signify an adversary's attempt to persist or execute code remotely. If confirmed malicious, this could allow attackers to maintain access, execute arbitrary commands, or further infiltrate the network, posing a severe security risk.
Detects a wide range of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with SafePay ransomware, including specific command lines, persistence mechanisms, defense evasion techniques, and host-based artifacts.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
Detects TTPs associated with the HazyBeacon backdoor, which has been observed targeting governmental entities in Southeast Asia. This rule identifies specific service creation for persistence, DLL sideloading of mscorsvc.dll, C2 communication via AWS Lambda URLs, and execution of known exfiltration tools from the C:\ProgramData directory.
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
Detecting LOLDrivers using www.loldrivers.io and MDE telemetry.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
Detects the persistence mechanism and command and control (C2) communication used by the Atomic macOS Stealer (AMOS) backdoor. This includes the creation of a LaunchDaemon, download of a helper binary, and C2 task polling.
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
Detects dll-sideloading attempts via licensingdiag.exe
Detects the creation of a scheduled task with specific names and comments used by the BugSleep backdoor for persistence, as seen in recent MuddyWater campaigns.
Page 289 of 401