Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the loading of a malicious 'version.dll' from the 'C:\Windows\ADFS\' directory, a technique used by the NOBELIUM threat group with their FoggyWeb backdoor to achieve DLL hijacking.
Detects the execution of suspicious child processes from macOS installer package parent processes. This includes various scripting interpreters like osascript, JXA, and common network utilities like curl and wget, which can be abused during preinstall or postinstall phases of a package installation.
This rule detects the presence of keywords commonly associated with well-known PowerShell exploitation frameworks such as Mimikatz and Metasploit within PowerShell script blocks. The keywords indicate attempts to perform privileged operations like manipulating access tokens, reading process memory, or other actions typically involved in credential dumping and privilege escalation. Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule identifies the creation or modification of Kubernetes Jobs or CronJobs within a Google Cloud environment. Adversaries may use these scheduled tasks to maintain persistence, execute malicious code, or escalate privileges within a Kubernetes cluster by scheduling containers to run at specific times or intervals.
Detects when Code Integrity identifies and blocks the loading of an image (DLL, EXE, etc.) that has a revoked digital certificate. This indicates an attempt to load untrusted or malicious code, potentially bypassing security controls. Event ID 3035 specifically notes cases where the image is allowed to load due to a kernel mode debugger being attached, which is a highly suspicious activity.
Detects when a kernel module that does not meet WHQL (Windows Hardware Quality Labs) signing requirements is loaded into the system. This can indicate the presence of unsigned or improperly signed drivers, which might be malicious or unstable. The rule specifically looks for Code Integrity Event IDs 3082 and 3083, which signify that such a module was loaded, even if allowed due to auditing policy.
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. This rule specifically looks for EventID 5145 (a network share access event) where the target file path ends with `\Internet Explorer\iertutil.dll` and the `SubjectUserName` does not end with a `$` (indicating a machine account, which is filtered out to reduce false positives).
This rule detects the creation of a remote thread within the KeePass.exe process. This activity is highly suspicious as it can indicate an attacker attempting to inject malicious code into KeePass to extract sensitive information, such as master passwords or stored credentials. This technique is commonly used by tools like KeeFarce and KeeThief for password dumping from KeePass.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
This rule detects specific command-line executions associated with Mustang Panda's activity, particularly targeting the Australian government, as reported by Lab52. The rule looks for two distinct patterns: the copying of 'SolidPDFCreator.dll' to a specific public user directory, and the modification of the Windows Registry 'Run' key to establish persistence for 'SolidPDF' using the same directory. These actions indicate an attempt to install and persist malicious software.
Detects the creation of scheduled tasks using the 'crontab' utility on macOS, specifically when the command line indicates the crontab job is being uploaded from the '/tmp/' directory. This behavior can be indicative of an adversary establishing persistence or executing malicious code.
Detects when an unsigned image (DLL, EXE, etc.) is loaded into the system, as reported by Windows Code Integrity. This can indicate attempts to bypass security controls, execute malicious code, or privilege escalation.
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. This rule specifically looks for Event ID 4662, indicating an operation on an object, where the ObjectType is 'WMI Namespace' and the ObjectName contains 'subscription'. This combination is indicative of WMI persistence mechanisms being created or modified.
Identifies when an Azure Kubernetes CronJob or Job is created or modified in Azure Cloud. Adversaries may use Kubernetes CronJobs or Jobs for scheduling execution of malicious code that would run as a container in the cluster, establishing persistence or executing malicious tasks.
This rule detects the use of the Resource Owner Password Credentials (ROPC) authentication flow. ROPC is generally discouraged because it requires applications to directly handle user credentials, increasing the risk of credential compromise. While it can be used for automated testing or legacy applications, its presence in other contexts may indicate a security weakness or an attempt to bypass more secure authentication mechanisms.
Detects process executions characteristic of Formbook malware. Specifically, it looks for processes originating from System32 or SysWOW64 directories with an executable extension, that then execute a command line containing '/c', 'del', and paths within 'C:\Users\<user>\AppData\Local\Temp\' or 'C:\Users\<user>\Desktop\'. It also covers a variant using '/C' and 'type nul >' for deletion on the Desktop. The rule aims to avoid false positives by excluding parent processes with command line parameters, suggesting an injection scenario where the parent process itself doesn't have complex command line arguments.
Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" directory as a service. This behavior has been reported by CISA as indicative of potential SNAKE malware activity.
Detects potential shellcode injection attempts by monitoring process access events where a process requests specific access rights (0x147a or 0x1f3fff) and the call trace contains 'UNKNOWN'. This behavior is characteristic of tools like Metasploit's migrate and Empire's psinject, which inject shellcode into other processes. The rule includes filters to reduce false positives from legitimate system processes like Wmiprvse.exe accessing Lsass.exe, Dell software interactions, and Microsoft Visual Studio processes.
This rule detects the creation of a property list (.plist) file within the `/Library/StartupItems/` or `/System/Library/StartupItems` directories on macOS. These directories are associated with a deprecated persistence mechanism where files placed within them are automatically executed at boot initialization. Adversaries can leverage this to establish persistence on a compromised system by ensuring their malicious code runs every time the system starts.
Detects the installation or execution of services associated with known hack tools or UAC bypass techniques. The rule specifically looks for Windows Service Control Manager events (7045 for service installation, 7036 for service state changes) in conjunction with service names or image paths that are indicative of tools like cachedump, gsecdump, pwdump, PsExec, or UAC bypass mechanisms.
This rule detects unusual parent or child processes associated with 'ImagingDevices.exe' (Windows Contacts). Specifically, it looks for 'ImagingDevices.exe' being spawned by 'WmiPrvSE.exe', 'svchost.exe', or 'dllhost.exe', or for 'ImagingDevices.exe' spawning any child process. This activity has been observed in connection with Bumblebee malware operations, where adversaries might abuse legitimate processes for execution or defense evasion.
Page 387 of 401