Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the registration of a debugger for a program that is available in the logon screen, commonly known as a sticky key backdoor. This technique involves modifying the Image File Execution Options (IFEO) registry key to launch an arbitrary executable (debugger) when a legitimate accessibility program (like sethc.exe or utilman.exe) is invoked from the logon screen. This can be used for persistence and privilege escalation to gain SYSTEM privileges.
Detects the execution of the 'execve_hijack' component of the Triple Cross eBPF rootkit. This specific file is used by the rootkit to elevate privileges by hijacking the 'execve' system call, often in conjunction with the 'sudo' command.
Detects the loading of a kernel driver that has been revoked by Code Integrity. This indicates an attempt to load a driver that is no longer trusted, potentially for malicious purposes or due to a known vulnerability. Event ID 3021 signifies a revoked driver load, while 3022 indicates a revoked driver load allowed due to a kernel mode debugger being attached.
This rule detects attempts to load an image (e.g., a DLL or executable) that has been blocked by Windows Code Integrity because its signing certificate has been revoked. This indicates that a potentially malicious or untrusted module is trying to execute on the system, and the operating system's integrity checks are preventing it.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. This is identified by monitoring Windows Security Event ID 5145 for file creations ending with `\wbem\wbemcomn.dll` and filtering out legitimate system accounts (those ending with '$').
Detects the creation of a service named 'ZzNetSvc' which is associated with the Moriya rootkit, as described in the 'Operation TunnelSnake' report by Securelist. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation.
Detects when adversaries delete important scheduled tasks related to system restore, Windows Defender, BitLocker, Windows Backup, Windows Update, Update Orchestrator, or Exploit Guard. This activity could indicate an attempt to disrupt system services or processes, potentially as a precursor to data destructive activities or to hinder defensive capabilities.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects changes to the "AutodialDLL" registry key, which can be used as a persistence method to load custom DLLs via the "ws2_32" library. This technique allows an attacker to execute malicious code every time a process loads the Winsock2 library.
This rule detects suspicious behaviors associated with the SOURGUM actor, as tracked by Microsoft. Specifically, it looks for the creation of processes with specific image paths related to 'Physmem.sys' or 'WimBootConfigurations.ini' within IME directories. Additionally, it identifies attempts to modify registry keys associated with Component Object Model (COM) objects, specifically InprocServer32 entries for CLSIDs {7c857801-7381-11cf-884d-00aa004b2e24} and {cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}, using the 'reg add' command.
Detects the creation, deletion, or update of AWS Glue Development Endpoints. This activity can be indicative of privilege escalation attempts or unauthorized resource manipulation within an AWS environment, as development endpoints provide an interactive environment for data processing.
This rule detects user activity that Azure AD Identity Protection has flagged as 'investigationsThreatIntelligence'. This risk event type indicates that a sign-in or user behavior is unusual for the user or consistent with known attack patterns, often leveraging threat intelligence feeds to identify suspicious activity. It suggests potential compromise of user accounts or malicious sign-in attempts.
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. This activity is indicative of the OMIGOD vulnerability exploitation.
Detect standard users login that are part of high privileged groups such as the Administrator group
Detects the installation of the NetSupport Manager client service on a Windows system. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service paths containing '\NetSupport Manager\client32.exe' or a service name of 'Client32'. This activity can be indicative of legitimate remote administration tool deployment or malicious use for persistence.
Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.
Detects the creation of a scheduled task using common command-line patterns associated with PowerSploit or Empire's default configurations. This rule specifically looks for `schtasks.exe` being executed by PowerShell with parameters indicative of task creation, including specific task names like 'Updater' and common scheduling triggers.
Detects modifications to Group Policy settings using `reg.exe` by looking for specific registry paths and keys commonly associated with Group Policy configurations. Malicious GPO modifications can be used to implement various other malicious behaviors, including privilege escalation and defense evasion.
Detects the modification of the 'Debugger' value within the Image File Execution Options (IFEO) registry key for various Windows accessibility tools. This technique is commonly used by adversaries to establish persistence and privilege escalation by replacing legitimate accessibility tools (like sethc.exe or utilman.exe) with a malicious executable that launches with SYSTEM privileges from the login screen.
Detects the creation of a Windows service named 'GoogleUpdate' with a specific ImagePath containing 'rundll32', 'FileProtocolHandler', and '\ProgramData\GoogleUpdate\GoogleUpdate.exe'. This pattern is associated with the Goofy Guineapig backdoor for persistence.
This rule detects potential remote thread injection activities associated with the Bumblebee malware. Specifically, it looks for instances where 'wabmig.exe', 'wab.exe', or 'ImagingDevices.exe' create a remote thread in 'rundll32.exe'. This behavior is indicative of how Bumblebee operates to execute its malicious payload.
Page 389 of 401