Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
KQL Query from file: Detecting Windows Downdate Abuse
KQL Query
KQL Query from file: CVE-2024-43452 PoC Detection
SPL Query
Detects the creation or modification of a registry key under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, a common persistence mechanism used by DarkCloud Stealer.
KQL Query from file: Git Critical Vulnerability CVE-2024-32002
KQL Query
Detects the use of GCC (or C89/C99) with the '-wrapper' option to execute a shell, which can be leveraged for privilege escalation, unauthorized command execution, or to break out from restricted environments. This technique is often documented in resources like GTFOBins.
SPL Query from file: Failed Authentication to Non-existing Accounts
Detects the use of the 'find' command in Linux to execute a shell. This behavior is often associated with privilege escalation, unauthorized command execution, or exploitation attempts, particularly when leveraging misconfigurations or vulnerabilities to break out of restricted environments.
Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing.
It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.
It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.
This rule detects the use of the 'flock' command in conjunction with common shell binaries to execute a shell. This behavior can be indicative of privilege escalation attempts, unauthorized command execution, or efforts to break out of restricted environments. The rule specifically looks for the 'flock' command being executed with the '-u' option and a command line containing paths to common shells like bash, dash, fish, sh, or zsh.
This rule detects the execution of shell programs (bash, dash, fish, sh, zsh) using the 'nice' utility on Linux systems. This behavior can be indicative of an adversary attempting to escalate privileges, execute unauthorized commands, or break out of restricted environments by manipulating process priority.
Detects suspicious child processes spawned by wermgr.exe (Windows Error Reporting manager). Adversaries may abuse wermgr.exe to execute arbitrary commands or scripts, often as a method of defense evasion or privilege escalation. The rule specifically looks for common command-line utilities and scripting engines being launched as children of wermgr.exe, while filtering out known legitimate rundll32.exe activity related to WerConCpl.dll.
Detects the creation or modification of an Active Directory forest trust where the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag is set in TdoAttributes. This includes cases where it's set alone (0x800) or in combination with the FOREST_TRANSITIVE flag (0x808), both indicative of the AORTA attack. For more comprehensive detection, consider backend-specific bitwise checks on TdoAttributes to ensure the 0x800 bit is set, regardless of other flags.
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
KQL Query
Detects potential AppDomainManager hijacking used by the OneClik APT campaign, where legitimate .NET ClickOnce applications (ZSATray.exe, umt.exe, ied.exe) load a suspicious DLL like 'history.tlb'. This technique (T1574.014) is used to load attacker-controlled assemblies and execute malicious code.
Detects the creation or modification of an Active Directory forest trust with only the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag set in TdoAttributes. This indicates the AORTA attack where TGT delegation is enabled without the trust also being marked as transitive. This complements the detection for the 0x808 value.
This rule detects the execution of "wusa.exe" (Windows Update Standalone Installer) when its parent process is located in suspicious directories. Attackers may leverage wusa.exe to bypass User Account Control (UAC) and elevate privileges by duplicating its access token. The suspicious parent process locations include common temporary directories, public user folders, and specific user profile subdirectories like Favorites, Favourites, Contacts, and Pictures.
detects a possible IPv6 DNS takeover using ISATAP configuration events (Event ID 4100) new ISATAP router was set successfully
Page 299 of 401