Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
The following analytic detects a spike in the number of API calls made to cloud security groups by a user. It leverages data from the Change data model, focusing on successful firewall-related changes. This activity is significant because an abnormal increase in security group API calls can indicate potential malicious activity, such as unauthorized access or configuration changes. If confirmed malicious, this could allow an attacker to manipulate security group settings, potentially exposing sensitive resources or disrupting network security controls.
This rule detects the execution of 'tscon.exe' with SYSTEM privileges. 'tscon.exe' is a legitimate Windows utility used to connect to or disconnect from a session on a Remote Desktop Session Host server. When executed as SYSTEM, it can be used by an attacker to hijack an active RDP session without requiring credentials or user interaction, leading to privilege escalation and lateral movement. This technique is often referred to as RDP session hijacking.
The following analytic identifies the creation of cloud compute instances by users who have not previously created them. It leverages data from the Change data model, focusing on 'create' actions by users, and cross-references with a baseline of known user activities. This activity is significant as it may indicate unauthorized access or misuse of cloud resources by new or compromised accounts. If confirmed malicious, attackers could deploy unauthorized compute instances, leading to potential data exfiltration, increased costs, or further exploitation within the cloud environment.
The analytic identifies cloud instances being modified by users who have not previously modified them. This activity is significant because it can indicate unauthorized or suspicious changes by potentially compromised or malicious users. If confirmed malicious, this could lead to unauthorized access, configuration changes, or potential disruption of cloud services, posing a significant risk to the organization's cloud infrastructure.
Looks for a new device registration in Entra ID preceded by medium or high-risk sign-in session for the same user within maximum 6h timeframe.
The analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.
Detects modification of autostart extensibility point (ASEP) in registry
Detects when users are added to privileged Active Directory groups. This is a critical event as it can lead to privilege escalation and unauthorized access to sensitive resources within an Active Directory environment. The rule specifically looks for Windows Event Code 4728, which indicates a member was added to a security-enabled global group, security-enabled local group, or security-enabled universal group.
The following analytic detects suspicious modifications to the registry that may indicate a UAC (User Account Control) bypass attempt via the SilentCleanup task. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry changes in the path "*\Environment\windir" with executable values. This activity is significant as it can allow an attacker to gain high-privilege execution without user consent, bypassing UAC protections. If confirmed malicious, this could lead to unauthorized administrative access, enabling further system compromise and persistence.
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could indicate an attempt to exploit CVE-2020-1048, a Windows Print Spooler elevation of privilege vulnerability, by registering a malicious printer port.
The analytic identifies changes to the Directory Services Restore Mode (DSRM) account behavior via registry modifications. It detects alterations in the registry path "*\System\CurrentControlSet\Control\Lsa\DSRMAdminLogonBehavior" with specific values indicating potential misuse. This activity is significant because the DSRM account, if misconfigured, can be exploited to persist within a domain, similar to a local administrator account. If confirmed malicious, an attacker could gain persistent administrative access to a Domain Controller, leading to potential domain-wide compromise and unauthorized access to sensitive information.
'Identifies when a recently created Group was added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is an expected addition.
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in Windows Server 2025 Active Directory environments. Successful usage of this tool can let attackers gain domain admin privileges by exploiting the BadSuccessor vulnerability.
This rule detects user logins from multiple distinct states or countries within a one-hour window, leveraging GeoIP enrichment. It specifically looks for successful login events where a user logs in from at least two different states or at least one country, indicating potential 'impossible travel' or suspicious access patterns.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack. This rule detects the execution of SharpSuccessor.exe or command-line arguments containing 'SharpSuccessor' in process launch events or specific Windows Security Auditing events (EventCode 4673) indicating a privileged service call. This activity is indicative of privilege escalation attempts in Active Directory environments, specifically leveraging 'CreateChild' permissions over Organizational Units (OUs) to escalate privileges to Domain Administrator.
This rule detects modifications to the Windows Registry related to the SilentProcessExit mechanism for the lsass.exe process. Specifically, it looks for changes in the registry key path 'microsoft\windows nt\currentversion\silentprocessexit\lsass.exe'. This technique can be abused by adversaries to configure a monitor program to dump the memory of the lsass.exe process, which often contains sensitive credential information.
This query identifies UAC elevated processes by analyzing launches of consent.exe (the process that performs UAC elevation).
The first parameter of consent.exe is the process ID being elevated, therefore we extract this value and use a combination of
that ID and the DeviceId to join it with processes that ran UAC elevated on the device. Given that process IDs can be reused,
a time filter is performed to ensure that the elevation request and the process launch occur within a specified period of time
(as written 30 minutes).
The first parameter of consent.exe is the process ID being elevated, therefore we extract this value and use a combination of
that ID and the DeviceId to join it with processes that ran UAC elevated on the device. Given that process IDs can be reused,
a time filter is performed to ensure that the elevation request and the process launch occur within a specified period of time
(as written 30 minutes).
This rule detects potential DLL sideloading by identifying the loading of specific system DLLs from non-standard, non-system locations. Adversaries often use DLL sideloading to execute malicious code by placing a malicious DLL in a directory where a legitimate application will load it instead of the intended system DLL. The rule includes a comprehensive list of DLLs commonly abused in sideloading attacks and filters out legitimate loads from known system directories to reduce false positives.
This rule identifies when sensitive ClusterRoles or Roles are being modified, deleted, or when their permissions are being escalated or bound in Azure Kubernetes Service (AKS). These operations can indicate an attempt to gain elevated privileges or disrupt access within the Kubernetes cluster.
This rule detects successful user logins where the user's termination date is in the past, indicating a login from a terminated employee. This could signify unauthorized access or a failure in account deprovisioning processes. The rule requires a context data source that provides user termination dates, such as Azure AD Context or Workday.
This rule detects suspicious activity following a successful login to the Azure AD PowerShell application. Specifically, it looks for a user performing multiple administrative actions within a short timeframe after logging in. These actions include adding or updating applications, adding delegated permission grants, or managing certificates and secrets for applications. This behavior is indicative of an attacker attempting to establish persistence or escalate privileges within an Entra ID environment after initial access.
Page 358 of 401