Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the deployment of AdaptixC2 agents by monitoring for suspicious rundll32.exe process executions indicative of reflective DLL injection. This includes rundll32.exe loading DLLs from suspicious directories (Temp, AppData, ProgramData) with potential reflective loader flags or exported functions, often triggered by parent processes like msiexec.exe or consent.exe. The rule also monitors for direct outbound network connections from rundll32.exe to known AdaptixC2 command-and-control infrastructure.
Detects suspicious execution patterns originating from Gitea act_runner that indicate potential container escape attempts or host namespace manipulation. The rule flags the use of sensitive docker flags such as --pid=host, --ipc=host, --cap-add=ALL, and security profile unconfining, alongside the execution of 'nsenter' or the existence of specific proof-of-concept markers related to container escape vulnerabilities.
Detects the AdaptixC2 agent (AdgNsy.exe) performing process injection into the Windows Address Book (WAB.EXE). The rule specifically monitors for the creation of AdgNsy.exe, its execution under the WMI Provider Host (WmiPrvSE.exe), and subsequent cross-process access to WAB.EXE, which is a known behavior of the AdaptixC2 framework utilized during Akira ransomware intrusions.
This rule detects the use of 'reg.exe' to disable User Account Control (UAC) by setting the 'EnableLUA' registry key to '0'. This action is a common technique used by malware, such as the Remcos RAT, or by adversaries attempting to persist with elevated privileges by weakening Windows security controls.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects the creation of new members in the 'Domain Admins' or 'Enterprise Admins' groups by monitoring Windows Security Event ID 4728. This event indicates that a member was added to a security-enabled global group. The rule specifically looks for additions to highly privileged administrative groups, which could indicate unauthorized privilege escalation or persistence.
Detects when a user account is deleted on a Windows system. This event (EventID 4726) is critical for monitoring potential malicious activity, such as an attacker attempting to remove traces of their presence or disrupt operations by deleting legitimate user accounts.
This rule detects the creation of scheduled tasks (Event ID 4697) where the command line contains either 'System' or 'Admin'. This could indicate an attempt to create a scheduled task that runs with elevated privileges or impersonates system/admin accounts for persistence or privilege escalation.
Detects process creations (EventID 4688) where the command line contains keywords indicative of loading or installing kernel modules or drivers. This activity can be associated with privilege escalation or persistence techniques used by adversaries.
Detects potential UAC bypass or COM hijacking activities by monitoring for anomalous process spawning patterns from Windows auto-elevating binaries (e.g., eventvwr.exe, fodhelper.exe, sdclt.exe) or suspicious child processes spawned by DllHost.exe from user-writable directories.
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects the creation of a root-privileged backdoor account named 'troot' on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for process-level indicators such as 'useradd' or 'adduser' usage, manual manipulation of '/etc/passwd' or '/etc/shadow' files, and subsequent 'su' activity or authentication logs associated with the 'troot' account. This pattern aligns with post-exploitation persistence mechanisms observed in UAT-8616 activity.
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
Detects indicators associated with the 'smart_window' campaign targeting Firefox, which attempts to exfiltrate browser history and page content via unauthorized registry modifications, malicious file artifacts, and specific network communication patterns to localhost or external URLs.
Detects instances where an executable loads a dynamic-link library (DLL) from its own directory, specifically focusing on files with 'minibrowse' or 'minijunk' in the path. This pattern is commonly used in DLL side-loading or directory-based hijacking to ensure that a malicious library is loaded instead of the intended legitimate library.
Page 40 of 401