Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
Detects the creation of new members in the 'Domain Admins' or 'Enterprise Admins' groups by monitoring Windows Security Event ID 4728. This event indicates that a member was added to a security-enabled global group. The rule specifically looks for additions to highly privileged administrative groups, which could indicate unauthorized privilege escalation or persistence.
Detects anomalous execution patterns of the Windows Package Manager (WinGet) DSC engine. It monitors for potential bypass of the standard winget.exe client by identifying direct calls to WindowsPackageManagerServer.exe with manual activation flags, unusual parentage of ConfigurationRemotingServer.exe, or usage of DSCourier-related binaries that interact with WinGet components, which may indicate unauthorized package installation or configuration management.
This rule detects potentially suspicious process creation or file modification activities associated with Autodesk applications or generic 'appcompat' paths. The detection logic flags processes executing with the '-uiDll' command-line argument and specific file operations (Creation/Modification) involving configuration or log files, often associated with unauthorized software tampering or suspicious binary execution patterns.
Detects activity associated with the SPECTRALVIPER malware loader, specifically identifying known malicious file hashes (system.config.xml, NotificationConfig.json) and cross-process memory injection patterns (RemoteMemoryAllocation, RemoteMemoryWrite, CreateRemoteThreadApiCall) initiated by specific suspect processes.
Detects the execution of schtasks.exe originating from Windows system management or package management server processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This activity may indicate administrative task automation or potentially malicious persistence and execution attempts using legitimate system binaries.
Detects OneDrive synchronization service processes or associated modules invoking suspicious token manipulation or privilege enumeration APIs, such as 'StealToken', 'Impersonate_ThisThread', or 'GetPrivileges'. This behavior is indicative of potential privilege escalation or process injection techniques disguised within legitimate cloud sync service processes.
Detects Gitea act_runner processes spawning Docker containers with dangerous configurations, such as privileged mode, host namespace mounts, or security-opt bypasses, followed by the execution of 'nsenter' or shell processes, which are indicative of a container escape attempt to the host.
Detects reconnaissance and exploitation setup activities associated with CVE-2026-46331 (pedit COW). The rule identifies processes enumerating kernel versions via system files or commands, checking unprivileged user namespace capabilities, and configuring network traffic control (tc) filters with pedit actions, which are critical precursors to leveraging the pedit page cache corruption vulnerability.
Detects reflective process injection activity where the IntelAudioService.exe process opens a handle to the OneDrive.Sync.Service.exe process, potentially using XGU::Manager::ProcessReflector class methods to inject shellcode.
Detects suspicious system calls by unprivileged users involving unshare, IPsec XFRM policy configuration, and kernel module loading. This specific sequence is used in the DirtyClone (CVE-2026-43503) exploit, which leverages local IPsec tunnels to perform page-cache corruption and modify sensitive system binaries in memory.
Detects the exploitation of the CVE-2025-8088 vulnerability in WinRAR, where a path traversal technique is used to extract malicious files directly into the Windows Startup folder. This pattern is associated with threat actors like Gamaredon to achieve persistence, typically by placing HTA downloaders that execute upon user logon.
Detects suspicious command execution on Linux-based SOHO/IoT devices, specifically targeting patterns associated with log deletion, unauthorized cron job modification, busybox utility abuse, and temporary directory execution. This activity is often linked to botnet recruitment and reconnaissance behaviors such as those observed in the JDY and Volt Typhoon campaigns.
Detects DLL side-loading where the signed Tencent UxEnhanceHost binary loads a malicious UxEnhance64.dll from randomized staging directories under C:\Users\Public\, a primary execution vehicle in the SilverFox campaign.
Detects HTTP response bodies containing common PE/Shellcode magic headers (MZ, PE, or NOP sleds) which are associated with the delivery of payloads designed to exploit or utilize the Windows KernelCallbackTable for process injection. The detection focuses on suspicious content delivered over HTTP connections.
Detects potential dynamic linker hijacking on Linux systems by monitoring for the use of non-standard LD_PRELOAD paths in process command lines or unauthorized modifications to the /etc/ld.so.preload configuration file, which can be used to inject malicious code into processes.
Detects modifications to Windows service registry keys (ImagePath, Start, or Type) performed by the native reg.exe or regedit.exe command-line utilities. This behavior is often associated with the creation or modification of services for persistence or privilege escalation.
Detects the installation of a new Windows service using sc.exe from a non-standard parent process (not services.exe) or the installation of a service with an executable path located in suspicious directories such as Temp, AppData, ProgramData, or Users folders.
Detects the creation of a kernel service pointing to a .sys file located outside the standard Windows system driver directory. This pattern is indicative of a kernel driver being dropped and registered for persistence, a common step in the installation of rootkits or malicious kernel-mode drivers.
This rule monitors for the creation of a new .sys file outside of the standard Windows system driver directories (System32 or SysWOW64) within a 15-minute window of a corresponding registry update to the 'ImagePath' of a service. This sequence is indicative of a persistence mechanism involving the installation of a potentially malicious kernel-mode driver, often used by rootkits or malware to achieve high-privilege execution.
Detects modifications or creation of 'StubPath' registry values within the 'Active Setup\Installed Components' registry key, where the value points to suspicious, user-writable directories. This technique is commonly used to establish persistence by executing a malicious file upon user logon.
Page 39 of 401