Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the modification of the "Ime File" registry value within the Keyboard Layouts key to point to suspicious folders. This technique can be used by attackers to load a malicious DLL into a process after sending a WM_INPUTLANGCHANGEREQUEST message, leveraging the Windows Input Method Editor (IME) feature for persistence or defense evasion. The rule specifically looks for DLL paths located in common temporary or user-writable directories, which are often abused by malware.
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.
Detects suspicious DLL loads by the Windows Print Spooler service from its backup driver folders. This behavior is indicative of exploitation attempts related to vulnerabilities like PrintNightmare (CVE-2021-1675, CVE-2021-34527) where an attacker can force the spooler service to load arbitrary DLLs, leading to privilege escalation or remote code execution.
This rule detects attempts to exploit the PrintNightmare vulnerability (CVE-2021-1675) by monitoring for DLL deletions within the Windows Spooler Service driver folder. Specifically, it looks for `spoolsv.exe` deleting files in `C:\Windows\System32\spool\drivers\x64\3\`, which is a common indicator of this exploit.
Detects signs of the exploitation of Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. This specific rule identifies the creation of an 'elevation_service.exe' file by 'msiexec.exe' within the Microsoft Edge application directory, which is a known indicator of this exploit.
This rule detects the execution of 'Autoit3.exe' when it is spawned by suspicious parent processes such as 'cmd.exe', 'KeyScramblerLogon.exe', or 'msiexec.exe'. It specifically filters out legitimate executions of 'Autoit3.exe' from standard installation paths to reduce false positives. This activity is indicative of the DarkGate malware infection chain, which leverages AutoIt3.exe to execute shellcode for process injection and command-and-control communication.
This rule detects the creation or activation of new user accounts in Okta with specific display names, such as 'svc_network_backup', which were identified as indicators of compromise during the Okta Support System 2023 breach. It aims to flag suspicious account activity that could indicate unauthorized access or persistence by an attacker. The rule can be improved by filtering out legitimate usernames if 'svc_network_backup' is a known and authorized account in the environment.
Detects the use of "vim" and its sibling commands (rvim, vimdiff) to execute a shell or proxy commands. This behavior can be indicative of privilege escalation, unauthorized command execution, or attempts to break out of restricted environments by leveraging the capabilities of these text editors to run arbitrary commands or scripts (e.g., via :!/, :lua, :py, or direct shell calls).
This rule detects exploitation indicators for CVE-2023-20198, a privilege escalation vulnerability in Cisco IOS XE Software Web UI. It looks for specific log messages related to Web UI installation operations, system configuration changes, or successful web logins, in conjunction with the use of specific user accounts ('cisco_tac_admin', 'cisco_support', 'cisco_sys_manager') that are not typically created by default or used by Cisco representatives. The combination of these events suggests an attempt to exploit the vulnerability.
Detects potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
Detects the creation of a scheduled task in the Windows Registry that is specifically associated with the Diamond Sleet APT group. This activity is linked to their exploitation of the TeamCity CVE-2023-42793 vulnerability, where they create a scheduled task named 'Windows TeamCity Settings User Interface' to establish persistence or execute malicious code.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the creation of a scheduled task named '\Windows TeamCity Settings User Interface' with a specific content string 'uTYNkfKxHiZrx3KJ'. This activity has been linked to the Diamond Sleet APT group exploiting the TeamCity CVE-2023-42793 vulnerability for execution, persistence, and privilege escalation.
Detects the creation of a named pipe with the pattern '\coerced\' which is indicative of the hack tool CoercedPotato. This tool is used for privilege escalation by coercing authentication from a target system.
Detects the execution of "Extexport.exe", a utility that is part of the Internet Explorer browser. This utility can be abused for DLL sideloading, specifically by loading "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll" if a folder is provided in the command line, or arbitrary DLLs if specific flags are used. This behavior is associated with malware like Astaroth and Guildma.
Detects the execution of "AccCheckConsole.exe" with command-line arguments indicative of its use for UI accessibility checking, which can be abused to load malicious DLLs. This utility allows providing a custom DLL containing a "verification routine" via the command line, enabling an attacker to inject and execute arbitrary code within the context of the legitimate `AccCheckConsole` process.
Detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that are configured with risky Extended Key Usages (EKUs) and allow the enrollee to supply the subject. This combination can be exploited for privilege escalation and credential access, as described in the 'Certified Pre-Owned' whitepaper, by allowing an attacker to request certificates with arbitrary subject names, potentially impersonating privileged accounts.
This rule detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that include the 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT' flag. This flag allows a user to specify the subject name in a certificate request, which can be abused for privilege escalation or credential access, particularly in scenarios involving misconfigured AD CS environments as described in the 'Certified Pre-Owned' research.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
Detects suspicious inbox manipulation rules that are set on a user's mailbox to delete or move messages or folders. This often indicates an attacker is trying to hide their activities or exfiltrate data by automatically moving emails.
Page 385 of 401