Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Detects "read access" requests on the services registry key.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.
Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded
Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task
Detects the load of a legitimate signed driver named HW.sys by often used by threat actors or malware for privilege escalation
Detects the load of the vulnerable Dell BIOS update driver as reported in CVE-2021-21551
Detects the load of a signed and vulnerable AVAST Anti Rootkit driver often used by threat actors or malware for stopping and disabling AV and EDR products
Detects potential COM object hijacking leveraging the COM Search Order
Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a suspicious or unusual location.
Detects Hurricane Panda Activity
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects driver load of the System Informer tool
Detects driver load of the Process Hacker tool
Detects loading of known malicious drivers via their hash.
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
Detects registry key used by Leviathan APT in Malaysian focused campaign
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.
Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM
Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file
Page 342 of 401