Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of a new Active Directory forest trust with both FOREST_TRANSITIVE (0x00000008) and CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flags set, indicative of the AORTA attack. This rule specifically checks for the TdoAttributes value 0x808, which represents the exact combination of these two flags. Attackers might set additional flags, which would result in a different TdoAttributes value, potentially leading to false negatives. Consider implementing backend-specific bitwise checks if your SIEM supports them for more comprehensive detection.
Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE".
It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
Detects modifications to specific registry keys under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). This includes keys related to Terminal Services, Security Providers, Safe Boot, Print Monitors/Providers, Network Provider Order, and LSA Authentication/Notification Packages. Such modifications can be indicative of persistence mechanisms used by adversaries.
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or modify the security policy. This could indicate an adversary attempting to understand or alter system security configurations for persistence, privilege escalation, or defense evasion.
Detects indicators of a UAC bypass method by mocking directories
Detects certificate creation with template allowing risk permission subject
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects modifications to various Windows Registry keys under `CurrentVersion` that are commonly used for autostart extensibility points (ASEPs). This includes `Run`, `RunOnce`, `RunOnceEx`, `RunServices`, `RunServicesOnce`, `ShellServiceObjectDelayLoad`, `Policies\System\Shell`, `Policies\Explorer\Run`, `Group Policy\Scripts`, `Explorer\ShellServiceObjects`, `Explorer\ShellIconOverlayIdentifiers`, `Explorer\ShellExecuteHooks`, `Explorer\SharedTaskScheduler`, `Explorer\Browser Helper Objects`, `Authentication\PLAP Providers`, `Authentication\Credential Providers`, and `Authentication\Credential Provider Filters`. Adversaries often modify these keys to establish persistence on a system by ensuring their malicious code executes automatically during system boot or user logon.
Detects modifications to the 'User Shell Folders' registry key, specifically the 'Startup' value. This technique is often used by adversaries to establish persistence by ensuring a malicious payload is launched automatically when a user logs in.
This detection identifies when an Azure Service Principal elevates privileges by adding itself to a new app role assignment. This activity is indicative of privilege escalation within an Azure Active Directory environment, where a service principal grants itself additional permissions.
Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory.
The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object.
Investigation of the loading application and its behavior is required to determining if its malicious.
The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object.
Investigation of the loading application and its behavior is required to determining if its malicious.
Detects potential COM object hijacking via modification of default system CLSID.
Detects indicators of a UAC bypass method by mocking directories
Detects direct modification of autostart extensibility points (ASEP) in the Windows Registry using the 'reg.exe' utility. This rule specifically looks for 'reg.exe' being executed with the 'add' command and targeting common autorun registry paths such as 'Run', 'Userinit', 'Shell', 'Windows', 'User Shell Folders', and 'AlternateShell'. Adversaries often modify these registry keys to establish persistence on a system, ensuring their malicious code executes upon system startup or user login.
This rule detects the creation or modification of Windows Registry Run keys that point to executable files located in suspicious folders. Adversaries often use Run keys for persistence, ensuring their malicious code executes automatically when a user logs in. The rule specifically looks for entries in common Run key paths (e.g., CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) where the associated executable's path is within directories commonly used by malware or temporary files (e.g., PerfLogs, ProgramData, Windows\Temp, AppData\Local\Temp, Recycle.Bin, Users\Default, Users\Public, or user profile subdirectories like Favorites, Music, Documents). A specific exclusion is included for legitimate Windows update processes that might write to temporary folders via RunOnce keys.
Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Detects modifications to specific registry keys under 'System\CurrentControlSet\Control\Session Manager' that are used for autostart extensibility points (ASEPs). These keys include 'SetupExecute', 'S0InitialCommand', 'KnownDLLs', 'Execute', 'BootExecute', and 'AppCertDLLs'. Adversaries often modify these keys to establish persistence or elevate privileges by ensuring their malicious code runs automatically during system boot or user login.
This rule detects attempts to establish persistence by modifying Windows Registry Run keys to execute PowerShell commands or scripts. It specifically looks for modifications to common Run key paths (CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) that contain keywords indicative of PowerShell execution, such as 'powershell', 'pwsh', 'frombase64string', download functions, hidden window styles, no profile, encoded commands, execution policy bypass, and various Invoke- commands (Invoke-Expression, Invoke-Command, Invoke-WebRequest).
The following analytic detects the creation of a new Group Policy Object (GPO) using Splunk's Admon data. It identifies events where a new GPO is created, excluding default "New Group Policy Object" entries. Monitoring GPO creation is crucial as adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. If confirmed malicious, this activity could allow attackers to control system configurations, deploy ransomware, or propagate malware, significantly compromising the network's security.
This analytic detects new UDP communication between a source and destination workload pair within a Kubernetes cluster. It uses Network Performance Monitoring (NPM) metrics from an OTEL collector via Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to identify new inter-workload communication. Such changes in network behavior can indicate potential security threats or anomalies, including unauthorized connections that may lead to data breaches, privilege escalation, lateral movement, or disruption of critical services.
This analytic identifies newly observed TCP communication between source and destination workloads within a Kubernetes cluster. It leverages Network Performance Monitoring metrics to compare recent network activity with historical data (past 30 days) to detect new inter-workload communications. Such new connections can indicate changes in application behavior or potential security threats, including unauthorized access, lateral movement, privilege escalation, data exfiltration, or disruption of critical services.
Page 300 of 401