Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects potentially malicious activity associated with the exploitation of CVE-2026-45115 in AnyDesk, including the creation of the 'adprinterpipe' named pipe, the spawning of suspicious elevated child processes (e.g., cmd.exe, powershell.exe) by AnyDesk processes, or the installation of services from an AnyDesk process context.
This rule detects modifications to the Image File Execution Options (IFEO) registry key for the agent service 'agntsvc.exe'. It identifies when an adversary configures a 'Debugger' registry value or a specific systray-related value, which is a known behavior of the Pay2Key ransomware for persistence and potential privilege escalation or process interference.
Detects the creation of files within the Windows startup directory or Windows tasks folder. The rule specifically excludes known system binaries like schtasks.exe and mstask.exe to reduce noise, and attempts to categorize the artifacts based on specific naming patterns.
Detects evidence of process hollowing involving 'ServiceModelReg.exe', often used to conceal malicious stealer activity. The rule correlates the creation of this process with subsequent unexpected outbound network connections from the same process/host, and also monitors for specific debug/log strings indicative of failed or active process hollowing attempts (RUNPE techniques).
Detects multiple signals associated with potential process injection or hollowing involving 'ServiceModelReg.exe'. The rule correlates process creation in a suspended state, memory injection-related actions, outbound network connections from the process, and specific debug strings often associated with automated process hollowing tools.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Detects obfuscated PowerShell scripts that utilize the Microsoft.Win32.UnsafeNativeMethods namespace to resolve native NT API functions (NtAllocateVirtualMemory, NtWriteVirtualMemory, etc.) and perform reflective code loading of a headerless PE payload from a staging directory (C:\ProgramData\wt1). This activity is associated with UAC-0226/GIFTEDCROOK threat campaigns.
Detects instances where the Claude Code AI agent or its subprocesses are used to establish persistence. This is achieved by monitoring for crontab modifications or direct writes to SSH authorized_keys files, which are common indicators of post-exploitation activity following an Axiom-style indirect prompt injection.
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) directly by known AI agent developer binaries (e.g., claude, cursor, aider) or indirectly via command shells spawned by these agents. This behavior may indicate an AI agent being leveraged to establish persistence or automate malicious actions on a host.
Detects persistence mechanisms used by the Mustang Panda threat actor (specifically the SHARDLOADER/ZOHOMURK malware variants). The rule monitors for the creation or modification of Windows Run registry keys using specific, known malicious value names (e.g., 'MediumNetMonIt', 'MicrosoftEdgeUpdateBrokerTask') or pointing to suspicious file paths located in 'C:\ProgramData\IDM\logs\' or within the 'VaultCache' folder.
Detects Cavern Agent trojanized uxtheme.dll that hides real payload logic behind the EnableThemeDialogTexture export (ordinal #20) among 82 inert stub exports
Detects persistence mechanisms frequently associated with SharkLoader and Cobalt Strike. The rule monitors for scheduled task creation using specific suspicious naming patterns, tasks pointing to SystemSettings.exe in non-standard directories (AppData/ProgramData), high-frequency task triggers, and registry run key modifications targeting SystemSettings.exe in similar suspicious paths.
Detects Android APK files that contain a combination of suspicious permissions and features often used for credential harvesting, specifically the binding of an accessibility service, SMS interception permissions, and overlay capability (System Alert Window).
Detects registry access attempts to the CLSID registration entries for Chrome, Brave, and Edge IElevator COM interfaces. These interfaces are designed for browser-internal maintenance tasks. Adversaries, such as the operators of WEES Stealer, abuse these interfaces by invoking the IElevator DecryptData method via out-of-process COM activation to decrypt App-Bound encryption keys, bypassing standard browser security boundaries.
This rule detects the installation or modification of kernel-mode drivers on Windows systems. It identifies potential driver installation activities using 'sc.exe' to create a service with a kernel-type driver image, or by monitoring Registry 'ImagePath' updates for services that point to '.sys' files, a common method for rootkit or malicious driver persistence.
Detects the creation, modification, or renaming of a specific property list file ('com.apple.system.services.activity') within the macOS LaunchAgents directory, a common technique used by attackers to maintain persistence on compromised systems.
Detects execution of processes named 'Finder' or 'Software Update' that originate from within the '/Library/Application Support/' directory on macOS. This pattern is indicative of potential masquerading where malicious binaries or persistent payloads are placed in shared application support folders to mimic legitimate system components.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
Detects successful assignment of highly privileged roles (Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator) to a user in Microsoft Entra ID (formerly Azure AD). This is often a sign of privilege escalation or persistence establishment by an attacker.
Detects the use of the Windows service control utility (sc.exe) to install or manage a malicious service named 'MixedSvc'. This activity, which involves pointing the service executable to 'Mixed Reality.exe' located in the Windows Media Player directory, is a persistence technique observed in Operation DragonReturn attributed to the Silver Fox threat group.
This rule detects potential exploitation of vulnerabilities (such as CVE-2026-33017) where mshta.exe or wscript.exe spawns PowerShell, followed by the addition of a persistent entry to the HKCU Run registry key targeting Node.js or JavaScript files.
Page 30 of 401