Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects various stages of exploitation associated with the CVE-2026-45257 'BUMSRAKETE' vulnerability, which targets FreeBSD kernels. It monitors for the execution of exploit binaries, compilation of source code related to the exploit, the presence of specific staging files in temporary directories, and the subsequent spawning of shells by the exploit process. It also identifies command-line arguments indicative of BUMSRAKETE activity.
Detects post-exploitation activities related to the CVE-2026-45257 BUMSRAKETE vulnerability on FreeBSD. The rule monitors for kernel module loading using kldload from suspicious directories, kldstat execution, unauthorized root-level crontab modifications, and suspicious root-level shell execution spawned from non-standard parent processes, all of which indicate potential persistence or rootkit installation following a local privilege escalation.
Detects execution of the BUMSRAKETE exploit targeting the CVE-2026-45257 FreeBSD kTLS-RX page-cache corruption vulnerability. The rule identifies the exploit binary launching from a non-privileged context alongside the creation of staging files used to corrupt system binaries and escalate privileges to root.
Detects unauthorized access to sensitive credential files (Docker, AWS, npm, PyPI, GCloud) by Node.js processes, specifically when those processes are triggered by common npm lifecycle scripts like preinstall, postinstall, or peer dependency scripts. This is a common pattern observed in supply chain attacks involving malicious npm packages.
This rule detects the creation of scheduled tasks using either schtasks.exe or PowerShell (Register-ScheduledTask) that exhibit high-risk indicators. These indicators include executing files from suspicious locations (AppData, Temp, or specific user-writable directories), the use of encoded PowerShell commands, or initiation by common remote access tools (sshd, ssh, or mstsc). This behavior is often associated with persistence mechanisms used by adversaries.
Detects execution and post-exploitation behaviors associated with the BUMSRAKETE exploit, specifically targeting page-cache overwrite privilege escalation (CVE-2026-45257). The rule identifies the presence of malicious binaries, staging artifacts in /tmp, and unprivileged processes spawning shells via SUID binaries (su, passwd) that indicate successful exploitation.
Detects execution of the RustDesk remote access tool from non-standard, user-writable directories, or when spawned by suspicious parent processes such as shells or scripting hosts. This rule is designed to identify unauthorized use of RustDesk as a persistence or remote access mechanism by adversaries attempting to bypass standard software management.
Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.
Detects suspicious execution patterns originating from or associated with crontab, crond, or anacron processes. The rule identifies potential persistence or malicious task scheduling by monitoring specific command-line indicators such as execution from /tmp or /dev/shm, unusual execution intervals, or specific shell command patterns associated with cron job abuse.
Detects the creation or modification of Windows Management Instrumentation (WMI) event subscriptions (filters, consumers, and bindings) that target potentially malicious destinations like cmd.exe, PowerShell, or files located in common user-writable directories like Temp or AppData, or multiple concurrent WMI subscription activities which may indicate persistence mechanisms.
This rule detects potential brute force attacks against Microsoft Exchange Outlook Web App (OWA) by monitoring for a high volume of 401 Unauthorized status codes from non-internal IP addresses. It also correlates these authentication events with subsequent post-authentication actions, specifically identifying mailbox logins followed by mailbox searching or export requests, which may indicate account compromise and unauthorized data collection or exfiltration.
This rule detects when critical Windows services or processes associated with Active Directory (NTDS, Netlogon, LSASS, LDAP) or the Print Spooler (Spooler, spoolsv.exe) crash multiple times (3 or more) on a machine within a 7-day period. This could indicate instability, a denial-of-service attempt, or a system compromise affecting core services.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects multiple successful RDP logons (LogonType 10) within a one-hour window by accounts containing '$' (often machine accounts) or 'admin' (privileged accounts). This behavior can be indicative of an adversary attempting to gain remote access and potentially deploy ransomware or other malicious payloads, especially if multiple source IPs are observed.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects suspicious DLL injection activity by identifying multiple DLL loads from unusual folders such as 'Temp', 'AppData', or 'Windows\Temp'. Adversaries often drop malicious DLLs into these directories and then inject them into legitimate processes to achieve persistence, privilege escalation, or defense evasion. The rule counts the number of DLL loads from these suspicious locations by the same initiating process on the same device, triggering an alert if five or more such loads occur, indicating a concerted malicious effort.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
This rule detects the creation of a Windows service where the service type is set to 'kernel' via the sc.exe command-line utility. This behavior is indicative of an attempt to load a kernel driver or perform low-level system modifications, which is often used by rootkits or malicious drivers. The rule filters out known trusted publishers to reduce noise.
Detects modifications to Windows Run or RunOnce registry keys by PowerShell or Reg.exe processes, specifically when originating from the WinGet DSC (Desired State Configuration) stack. The rule flags entries where the registry value points to potentially sensitive/user-writable directories or contains evidence of encoded command execution (e.g., PowerShell base64 encoding or common obfuscated syntax).
Detects the creation of new Windows services through suspicious or unexpected process chains. This includes services spawned by WinGet/DSC components, services created by sc.exe where the process path points to user-writable directories (e.g., Temp, AppData, User profiles), or system event logs (Event ID 7045) indicating service installation from non-standard locations. This rule is designed to identify potential persistence mechanisms or privilege escalation attempts involving unauthorized service creation.
This rule monitors for potential DLL sideloading by detecting specific known executable names loading suspicious modules such as 'dtlcrashcatch.dll' or 'setupui.dll'. It further validates the suspicion by analyzing command-line arguments for sideloading indicators (e.g., '-uidll', '/appmodel') or high-entropy arguments, and checking if the loaded module resides in the same directory as the host process, which is a common pattern for DLL sideloading.
Page 45 of 401