Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the use of the OAuth 2.0 device code authentication flow within an environment. While legitimate for input-constrained devices, its presence in other scenarios warrants investigation as it could indicate a misconfigured application or malicious activity. The rule specifically looks for "Device Code" in Azure sign-in logs.
Detects when a role privilege is deleted in Google Workspace. This could indicate an attempt to remove or modify administrative access, potentially as part of a privilege de-escalation by an attacker to avoid detection, or to clean up after an attack.
Detects potential token impersonation and theft on Windows systems. This rule specifically looks for successful logon events (EventID 4624) with a LogonType of 9 (NewCredentials), where the LogonProcessName is 'Advapi' and the AuthenticationPackageName is 'Negotiate', combined with an ImpersonationLevel indicating impersonation. This combination of events is indicative of an attempt to duplicate and impersonate an existing access token, often used for privilege escalation or defense evasion.
This rule detects the use of potentially suspicious keywords within PowerShell scripts that are often associated with exploitation frameworks or advanced attack techniques. Specifically, it looks for reflection-related keywords like 'System.Reflection.Assembly.Load', '[System.Reflection.Assembly]::Load', '[Reflection.Assembly]::Load', 'System.Reflection.AssemblyName', 'Reflection.Emit.AssemblyBuilderAccess', 'Reflection.Emit.CustomAttributeBuilder', and keywords related to interop services and process manipulation such as 'Runtime.InteropServices.UnmanagedType', 'Runtime.InteropServices.DllImportAttribute', 'SuspendThread', and 'rundll32'. These keywords can indicate attempts to load assemblies in-memory, interact with unmanaged code, or manipulate processes, which are common tactics used by malware and red teaming tools.
This rule identifies when an owner is removed from an application or service principal within Azure Active Directory. This activity could indicate an attempt to remove legitimate administrative access or to obscure malicious activity by removing an owner who might detect it.
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify successful exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Detects the creation of named pipes that match specific patterns known to be used by Cobalt Strike's Malleable C2 profiles. These patterns are often indicative of Cobalt Strike beacon activity on a system.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag. This activity is suspicious when not initiated by the expected parent process, 'AppVClient.exe'.
Detects when a user account's User Account Control (UAC) flags are modified to enable weak encryption (DES) or disable Kerberos pre-authentication. This configuration can make the account vulnerable to Kerberoasting attacks, where an attacker can request a service ticket for the user and then offline crack the NTLM hash of the user's password if DES encryption is allowed, or if pre-authentication is disabled.
Detects updates to scheduled tasks (EventID 4702) where the new task content (`TaskContentNew`) contains suspicious keywords. These keywords include common temporary or user-writable directories often used by malware for staging or execution, combined with suspicious commands or scripting interpreters. This rule aims to identify adversaries establishing persistence or executing malicious code via scheduled tasks.
This rule identifies sign-in attempts from geographically distant locations within a short timeframe, which is indicative of an "impossible travel" scenario. It also considers if one of these locations is atypical for the user based on their past behavior. This pattern often suggests that an attacker has compromised user credentials and is attempting to access the account from a new, unusual location, potentially using a VPN or proxy service to mask their true origin.
Detects the creation, modification, or deletion of Kubernetes RoleBindings and ClusterRoleBindings in Google Cloud. These actions can indicate an adversary attempting to escalate privileges or maintain persistence within a Kubernetes cluster by granting themselves or other accounts additional roles and permissions.
Detects when an AWS account makes changes to the ingress or egress rules of a security group. This activity can indicate an attacker attempting to open new attack vectors, exfiltrate data over the network, or allow compromised machines to contact a command and control (C2) server.
This rule identifies 'impossible travel' events where a user's activities originate from geographically distant locations within a time period that is too short for physical travel between those locations. This often indicates a compromised account being accessed from multiple locations simultaneously or in rapid succession, potentially using different IP addresses or devices.
Detects the addition of a new Federated Domain in Microsoft Exchange. This event can be indicative of credential abuse or the establishment of a backdoor via federated identities, potentially in the context of a Golden SAML attack.
Detects suspicious command executions on Linux systems, specifically focusing on modifications to file permissions (chmod 777, chmod u+s) and copying of shell binaries (/bin/ksh, /bin/sh). These actions are often associated with malware or hacking activities, such as privilege escalation or establishing persistence.
Identifies when a service principal was removed in Azure. This action could indicate an attempt to remove legitimate service accounts to hinder detection or to clean up after malicious activity.
This rule detects changes to the device registration policy within Azure. Such modifications can be used by adversaries to evade defenses, escalate privileges, or enable unauthorized device registrations, potentially leading to broader access to the environment. The detection specifically looks for 'Set device registration policies' activity within the 'Policy' category of Azure Audit Logs.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
Detects suspicious scheduled task creation events by analyzing the task content for unusual paths (e.g., temporary directories, user-writable locations) and the presence of commonly abused command-line utilities or scripting interpreters. This rule aims to identify persistence or execution mechanisms leveraging scheduled tasks.
Page 386 of 401