Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of scheduled tasks using schtasks.exe by processes that are not digitally signed by Microsoft Corporation, as well as the loading of taskschd.dll by non-standard/unsigned processes. This behavior is indicative of potential persistence mechanisms or unauthorized task scheduling activity.
Detects the creation of new scheduled tasks using the Windows schtasks.exe command-line utility. This behavior is commonly used by adversaries for persistence by ensuring malicious payloads, loaders, or backdoors are re-executed upon system events or intervals.
Detects the modification of Windows Registry 'Run' keys using the command-line utility 'reg.exe'. This technique is commonly employed by adversaries to establish persistence, ensuring that malicious code, such as the MiniJunk backdoor, executes automatically upon system login.
Detects the use of 'docker cp' to copy files out of a container to the host filesystem. This rule identifies suspicious patterns that may exploit the path traversal vulnerability CVE-2026-43503, which allows an attacker to escape the intended destination directory on the host.
Detects the creation of scheduled tasks using the Windows schtasks utility where the task action points to a file located in common user-writable directories such as AppData, Temp, Users\Public, or Downloads. This behavior is frequently associated with persistence mechanisms used by malware and backdoors.
Detects instances where legitimate, signed executables (specifically associated with Citrix, VMware, FortiGate, or Microsoft) load an unsigned DLL from the same directory as the executable. This pattern is indicative of DLL side-loading (Search-Order Hijacking), often used by attackers to gain persistence or mask malicious code execution under a trusted process. The rule excludes standard Windows System32/SysWOW64 directories to focus on non-standard, potentially attacker-controlled, file locations.
Detects instances where the WinRAR archive utility spawns a PowerShell process with command-line arguments typically associated with obfuscated or fileless execution. The detection specifically flags PowerShell commands that employ techniques such as base64 encoding, execution policy bypass, hidden window styles, or commands containing indicators of in-memory process manipulation such as NtAllocateVirtualMemory or memory allocation constants.
Detects execution of persistence-related commands such as cron job modifications or SSH key additions originating from development-related parent processes or installation commands like npm/pip. This behavior is indicative of potential supply chain compromises or malicious actors abusing development environments to maintain access.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
Detects WinRAR creating .lnk files within Windows Startup directories under suspicious conditions. The rule looks for indicators of NTFS Alternate Data Stream (ADS) path traversal, where WinRAR might be instructed to write a file into a sensitive directory using a path like 'archive.rar:stream\malicious.lnk'. This behavior is indicative of exploitation attempts related to vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
Detects the execution of 'i.bat' script accompanied by subsequent commands intended to exhaustively impair security defenses on a Windows host. The rule identifies the combination of the script execution and targeted commands to disable Microsoft Defender, stop Sysmon/Filebeat services, and uninstall or misconfigure ModSecurity modules.
Detects instances where common Windows processes (explorer.exe, svchost.exe, dllhost.exe) load an unsigned module (DLL) from user-writable directories, such as AppData, Downloads, or Temp folders. This behavior is a common indicator of potential DLL sideloading or malicious code execution originating from user-controlled space.
Detects use of Active Setup registry keys for per-user program execution on login
Detects the TonRAT malware establishing persistence by modifying Windows Run or RunOnce registry keys. The rule specifically monitors for registry value creation or modification triggered by scripting or runtime host processes such as node.exe, bun.exe, wscript.exe, or cscript.exe, when the referenced persistence path points to locations commonly used for malicious payloads, such as AppData, ProgramData, or Temp directories, or involves JavaScript files.
Detects the initialization of unprivileged user and network namespaces combined with specific IPsec tunnel configurations (xfrm/esp/veth). This sequence of operations is a known prerequisite for exploiting the DirtyClone (CVE-2026-43503) vulnerability, a Local Privilege Escalation (LPE) in the Linux kernel.
Detects indicators of SSH-based lateral movement and credential access, including suspicious SSH command-line flags (e.g., BatchMode, StrictHostKeyChecking), manual enumeration of SSH keys via ssh-add, inspection of agent socket variables, and unauthorized access to critical SSH configuration and identity files by non-standard processes.
EXPERIMENTAL: This rule detects RoguePlanet indicators when the Microsoft Defender Antimalware Service Executable (MsMpEng.exe) creates or modifies an executable (.exe, .dll, .sys) file within the System32 or SysWOW64 directories. This behavior can indicate a potential local privilege escalation (LPE) or other malicious activity, especially if Defender is being abused for remediation in a SYSTEM context. The rule specifically highlights 'wermgr.exe' as a high-interest target, but is generalized to catch any PE file.
This rule detects suspicious activity associated with the 'MixedSvc' service and potential DLL side-loading. It identifies the creation of a Windows service named 'MixedSvc' using sc.exe, the execution of 'Mixed Reality.exe' from a Windows Media Player directory, the side-loading of 'nvdaHelperRemote.dll' within the Windows Media Player directory, and the execution of svchost.exe with 'Mixed Reality.exe' as its parent/causality actor, which is indicative of malicious injection and persistence mechanisms.
Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself.
Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.
Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.
Detects DcRAT (Operation DragonReturn) malware beaconing to a known C2 IP address (223.26.63.40) following the execution of suspicious sideloaded binaries, specifically 'Mixed Reality.exe' or 'COU_ITR-1_to_4_AY2026-27.exe', which then inject malicious code into svchost.exe.
This rule detects network activity indicating a potential modification or interaction with Microsoft Entra ID (Azure AD) multifactor authentication (MFA) settings. Specifically, it looks for POST requests to the Microsoft Graph API targeting authentication methods (e.g., phoneAuthenticationMethod), which may be indicative of an attacker modifying MFA settings to bypass security controls or register rogue authentication devices.
Page 41 of 401