Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Identifies when a service account in Azure Kubernetes Service is modified or deleted. This could indicate an adversary attempting to disrupt services, remove access, or manipulate accounts for persistence or privilege escalation within the Kubernetes cluster.
Detects the modification or deletion of Kubernetes RoleBindings or ClusterRoleBindings within Azure Kubernetes Service. These actions can indicate an adversary attempting to escalate privileges, maintain persistence, or disrupt services by altering access control configurations.
Detects when a Kubernetes CronJob or Job is created, modified, or deleted. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.
This rule identifies process creations or file creations where the associated file has been tagged as an 'exploit' by VirusTotal. It leverages enrichment from a VirusTotal integration to flag potentially malicious activity related to exploit execution.
This rule detects the creation of a Kubernetes container that includes a hostPath mount. A hostPath volume allows a directory or file from the node to be mounted directly into the container. Attackers with permissions to create pods can leverage writable hostPath volumes to perform container escapes, potentially gaining access to the underlying host node by using techniques like chroot.
Detects the creation of a "privileged" container in Kubernetes. A privileged container has root capabilities on the host, allowing it to access and modify host processes, network operations, IPC calls, file system, mount points, and SELinux configurations. This action can indicate a threat actor attempting container breakout or privilege escalation. The rule specifically looks for 'create' verbs on 'pods' resources where 'capabilities' are present, which implies elevated privileges.
This rule detects remote RPC calls specifically targeting the Task Scheduler service (SASec) to read information about scheduled tasks. This activity is often associated with reconnaissance by adversaries attempting to understand the environment's scheduled jobs.
This rule detects buffer overflow attempts in Unix system log files by looking for specific keywords. These keywords include phrases indicating an attempt to execute code on the stack, known exploit strings like '0bin0sh1', a long string of 'A's (which can be indicative of buffer filling), and messages related to 'stack smashing detected'. The rule aims to identify malicious activity where an attacker tries to overflow a buffer to gain control of program execution, potentially leading to privilege escalation.
This rule detects the creation of scheduled tasks on Windows systems using the `schtasks.exe` command-line utility. It specifically looks for process launch events where the command line contains `schtasks` and `/create` (case-insensitive). This activity is often used by adversaries for persistence, privilege escalation, or lateral movement.
This rule detects when a user is added to an administrative role within Office 365. While adding users to administrative roles is not inherently malicious, it is a sensitive action that warrants validation due to the elevated privileges granted. The rule specifically looks for the 'Add member to role.' event type within Office 365 and requires the role to be present in a predefined watchlist of sensitive roles.
Detects remote RPC calls to read information about scheduled tasks via AtScv. This activity can indicate an adversary performing reconnaissance to understand the environment and identify potential lateral movement opportunities.
This rule detects the execution of various Windows-based hacktools by matching their import hash (imphash). This method allows for detection even if the tool's filename has been changed. The rule includes imphashes for tools such as PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, PPLDump, NanoDump, HandleKatz, DripLoader, UACMe, WCE, Sliver Stagers, Dumpert, SysmonEnte, SysmonQuiet, ShaprEvtMute Hook, Forkatz, PPLKiller, Backstab, Forensia, EDRSandBlast, and EDRSilencer.
This rule detects remote RPC calls made to query information about scheduled tasks. Specifically, it monitors for RPC Firewall events (EventID 3) with a specific InterfaceUuid (86d35949-83c9-4044-b424-db363231fd0c) which corresponds to the ITaskSchedulerService. The rule filters out common operational numbers (OpNum 1, 3, 4, 10, 11, 12, 13, 14, 15) to reduce false positives, focusing on less common or potentially malicious reconnaissance activities related to scheduled tasks.
Detects when a Kubernetes RoleBinding or ClusterRoleBinding is created, modified, or deleted. This activity can indicate privilege escalation attempts or unauthorized access within a Kubernetes cluster.
This rule detects a sequence of events indicating the creation of a user account, a successful login by that user, and the subsequent deletion of the same user account within a 4-hour timeframe. This pattern is often indicative of an adversary creating temporary accounts for malicious activities, using them, and then removing them to cover their tracks or evade detection. The rule specifically targets Windows login events (event code 4624).
This rule detects the launch of processes whose executable files are identified as malicious by Google Safe Browsing and exhibit low prevalence within the environment. Specifically, it looks for process launch events where the SHA256 hash of the executable matches a hash flagged as 'CRITICAL' severity by Google Safe Browsing. Additionally, the rule filters for executables that have been observed on a maximum of 3 distinct machines over a 10-day rolling period, indicating low prevalence and a higher likelihood of being a targeted or novel threat.
This rule detects the creation of processes related to the NT Virtual DOS Machine (NTVDM), specifically `ntvdm.exe` and `csrstub.exe`. NTVDM allows 16-bit Windows applications and both 16-bit and 32-bit DOS applications to run on 32-bit Windows operating systems. While NTVDM is a legitimate Windows component, its execution might be unusual in modern environments, especially 64-bit systems where it's not natively supported, and could indicate an attempt to run legacy or potentially malicious 16-bit code.
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack discovered by Yuval Gordon (@YuG0rd) from Akamai. It allows a low-privileged user with 'CreateChild' permissions over any Organizational Unit (OU) in an Active Directory domain to escalate privileges to Domain Administrator. This detection rule identifies execution patterns or behavioral indicators linked to SharpSuccessor activity, which may signal privilege escalation attempts in Active Directory environments.
Detects buffer overflow attempts in Unix system log files
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as: A Network Trojan was Detected, Successful Administrator Privilege Gain, Successful User Privilege Gain, Attempt to Login By a Default Username and Password, Known malware command and control traffic, Known malicious file or file based exploit, Known client side exploit attempt, Large Scale Information Leak. These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
Page 359 of 401