Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects when an attacker attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This action can be part of privilege escalation or defense evasion tactics to bypass UAC prompts.
This rule detects suspicious scripting commands within WMI event consumers, which can be indicative of persistence mechanisms. Specifically, it looks for PowerShell web download commands (`new-object net.webclient .downloadstring`, `new-object net.webclient .downloadfile`), common PowerShell execution flags (`-nop`, `-noprofile`, `-decode`, `-enc`), and references to `WScript.Shell` or `System.Security.Cryptography.FromBase64Transform` within the 'Destination' field of WMI event logs. These patterns are frequently used by attackers to execute malicious scripts or download payloads via WMI persistence.
This rule detects the creation or modification of a registry run key that exhibits characteristics associated with the 'Small Sieve' malware. Specifically, it looks for a registry path containing '\Microsoft\Windows\CurrentVersion\Run\' combined with either the intentional typo 'Microsift' in the TargetObject or the string '.exe Platypus' in the Details field. These indicators are known to be used by the Small Sieve malware for persistence.
Detects sign-in attempts with properties (e.g., device, location, browser) that are unusual or unfamiliar compared to a user's past sign-in history. This rule leverages Azure AD Identity Protection's risk detection capabilities to identify anomalous sign-ins.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
Detects the loading of an unsigned kernel module on a Windows system, which can indicate attempts to bypass security controls, establish persistence, or escalate privileges. This event is logged by Windows Code Integrity when it determines that a kernel module without a valid digital signature is being loaded.
Detects the installation of the 'RTCore64' service, which is associated with Micro-Star MSI Afterburner. This service can be abused by attackers to load vulnerable drivers, a technique often referred to as 'Bring Your Own Vulnerable Driver' (BYOVD) for privilege escalation or defense evasion.
This rule detects instances where the 'winlogon.exe' process initiates outbound network connections to public IP addresses. Winlogon.exe is a critical Windows component responsible for user logon/logoff and the secure attention sequence. Typically, winlogon.exe should not be making outbound network connections to public IPs. Such activity could indicate compromise, potentially by malware like BlackLotus, which has been observed to leverage winlogon.exe for malicious purposes, including command and control or data exfiltration.
Detects a typical pattern of a Cobalt Strike Beacon Object File (BOF) attempting to inject into other processes. This rule specifically looks for process access events where the call trace indicates a sequence from ntdll.dll to KERNELBASE.dll, followed by an unknown module, combined with specific granted access rights (0x1028 or 0x1fffff). This pattern is indicative of certain process injection techniques used by Cobalt Strike BOFs.
Detects a specific image load pattern where 'svchost.exe' loads 'clfsw32.dll'. This pattern has been observed in the context of a tool named PRIVATELOG, which is associated with advanced persistent threat (APT) activities, and is considered rare under legitimate circumstances. This behavior could indicate process injection or other forms of defense evasion.
Detects the creation or modification of scheduled cron jobs where the command line argument contains '/tmp/'. This behavior is often indicative of an adversary attempting to establish persistence or execute malicious code from a temporary directory using the cron utility.
Detects the usage of the 'usermod' command to add a user to either the 'root' or 'sudoers' group on a Linux system. This activity can indicate privilege escalation or persistence mechanisms by an attacker.
Detects the execution of the 'jamf' binary with specific commands that could be used by attackers for privilege escalation, bypassing security controls, or modifying system configurations. This includes creating user accounts, managing the JAMF framework, removing MDM profiles, resetting passwords, and setting computer names.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
This rule detects the creation or modification of AppX packages in suspicious file system locations. Adversaries may place malicious AppX packages in common temporary or public directories to evade detection or achieve persistence. The rule specifically looks for Event ID 854 from the 'appxdeployment-server' service, indicating an AppX package being added to the processing pipeline, and checks if the package's path contains known suspicious locations such as public user directories, temporary folders, or desktop/downloads folders.
Detects suspicious WMI event filter and command line event consumer creation or modification based on WMI and Security Logs. This rule specifically looks for EventID 5861 (WMI filter to consumer binding) and EventID 5859 (WMI filter registration) in conjunction with common consumer keywords like 'ActiveScriptEventConsumer' and 'CommandLineEventConsumer'. It excludes legitimate SCM Event Provider activity.
This rule detects when a driver is loaded from a temporary directory. Adversaries may load malicious drivers from temporary locations as part of persistence, privilege escalation, or defense evasion techniques. Loading drivers from temporary directories is often an unusual behavior for legitimate system operations and can indicate suspicious activity.
This rule detects the creation of executable files with suspicious names or extensions. Specifically, it looks for files ending with '.exe' that are appended to common system directory names (e.g., ':\$Recycle.Bin.exe', ':\MSOCache.exe') or other executable extensions (e.g., '.bat.exe', '.sys.exe'). This pattern is often used in unquoted service path vulnerabilities or to masquerade malicious executables as legitimate system files.
This rule detects the creation of specific files that indicate interactive PowerShell usage within the SYSTEM user context. The rule looks for the creation of 'ConsoleHost_history.txt' or 'StartupProfileData-Interactive' files in the 'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\' or 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\' directories respectively. The presence of these files in the SYSTEM profile suggests that PowerShell was used interactively by the SYSTEM account, which is highly unusual and could indicate privilege escalation or malicious activity.
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts.
Page 388 of 401