Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule identifies endpoints identified as EMS or FortiClient that exhibit an unusually high number of login events (greater than 20) or a high number of unique accounts logging in (greater than 10) within a specific timeframe. This behavior may indicate unauthorized access attempts, automated password spraying, or potential lateral movement activity directed at remote access infrastructure.
Detects a process interacting multiple times with VMware Tools (vmtoolsd.exe) followed by multiple interactions with WMI Restrictions registry keys within a 15-minute window. This behavioral pattern is indicative of potential privilege escalation or environment discovery techniques where an adversary attempts to modify security restrictions while masquerading or interacting with legitimate virtualization management components.
Detects DLL side-loading activity associated with Operation Turb00's IDAT Loader, used to deploy the Vidar infostealer. The rule identifies specific legitimate host binaries (e.g., AlphVector.exe, ssh-add.exe) executing from non-standard directories like ProgramData, AppData, or Temp and loading unsigned or untrusted DLLs known to be trojanized.
Detects automated post-compromise activity associated with Bluekit Browser-in-the-Middle (BitM) attacks. The rule identifies a pattern of a successful user login followed rapidly (within 10 minutes) by a password change and new passkey enrollment, indicating an adversary is securing their persistence after initial session hijacking.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Detects successful ROPC (Resource Owner Password Credential) token acquisitions targeting Microsoft Graph (00000003-0000-0000-c000-000000000000) where Conditional Access was not applied and only single-factor authentication was satisfied. This pattern indicates abuse of hidden CA policy scope exclusions introduced by CVE-2025-0309, enabling token issuance without MFA or device compliance enforcement.
Detects the execution of mavinject.exe with the /INJECTRUNNING command-line argument. This utility is a signed Microsoft binary that can be abused by adversaries to inject arbitrary DLLs into the address space of running processes, a technique often used to evade detection or achieve code execution.
Detects potential persistence attempts via WMI event subscriptions. The rule monitors for the creation of WMI event consumers using 'wmic.exe' with suspicious command line arguments, or the use of 'mofcomp.exe' to compile MOF files by non-standard, non-Microsoft signed processes.
Detects when a user or service principal is assigned the 'Owner' or 'Contributor' role at the Subscription scope in Azure. This activity is often associated with privilege escalation and persistent access techniques.
This rule detects successful self-service password reset (SSPR) operations performed by users from IP addresses geolocated to a country that does not match their typical sign-in activity over the past 30 days. This behavior may indicate account takeover where an adversary has compromised credentials and is resetting the password to maintain access or gain further persistence.
Detects high-frequency SMB (Logon Type 3) authentication events targeting Domain Controllers, specifically involving suspicious or generic accounts such as 'ANONYMOUS LOGON', 'Guest', empty usernames, or machine accounts. This behavior is indicative of network reconnaissance, session enumeration, or brute-force attempts targeting the domain.
Detects execution patterns associated with CVE-2026-46331 (pedit COW exploit), which uses a user namespace unshare operation, followed by tc pedit action abuse to perform page cache poisoning on /bin/su to achieve root privilege escalation. The rule monitors for the exploit binary, unshare namespace creation, tc command interaction, unauthorized root shell spawning by su/sudo, and attempts to clear page caches.
Detects a non-browser process creating a remote thread with a LoadLibraryW start function targeting chrome.exe, msedge.exe, or brave.exe, which is indicative of a suspend-inject-resume technique used to load unauthorized DLLs into a browser process, potentially bypassing browser protections such as App-Bound Encryption.
Detects execution and compilation activities associated with the DirtyPipe (CVE-2022-0847) vulnerability, which allows an unprivileged user to overwrite data in read-only files, leading to privilege escalation to root. The rule tracks common exploit filenames, compilation patterns, and specific commands used for privilege escalation via unshare or su.
Detects a suspected 5-step exploit sequence targeting CVE-2026-43503 on Linux systems. The rule monitors for unprivileged user and network namespace creation, followed by XFRM state modification, kernel module loading, raw ESP socket creation, and finally writing to /proc/[pid]/mem to facilitate page-cache corruption and bypass Copy-on-Write (CoW) protections.
Detects modifications to sensitive Group Policy Object (GPO) attributes, specifically those related to file system paths, machine/user extensions, or version numbers, using Windows Security Event ID 5136. These attributes are often targeted during GPO modification to establish persistence, escalate privileges, or deploy malicious configurations across a domain.
Detects modifications to the AdminSDHolder object in Active Directory via Windows Security Event ID 5136. The AdminSDHolder object maintains the security permissions for all objects protected by the AdminSDHolder process. Adversaries often modify this object to establish persistence and gain unauthorized access to highly privileged accounts within the domain.
Detects in-memory DLL injection where a module is loaded into process memory without a backing file path on disk (action_module_path is null or empty). This technique, often referred to as reflective DLL injection, is used to evade detection. The rule further refines detection by flagging cases where the hosting process itself originates from an unusual or user-writable path, which can be indicative of DLL sideloading. This behavior is consistent with malware like Backdoor.Mistic or ModeloRAT, deployed by threat groups such as Woodgnat (KongTuke).
Detects a sequence of events where a non-root user attempts to manipulate kernel components (specifically involving xfrm/esp modules via ip or modprobe) followed immediately by a sudo or su command, suggesting an attempt to load malicious kernel modules or exploit kernel vulnerabilities to escalate privileges.
This rule detects the modification of the SID History attribute on Active Directory accounts (Event ID 4765) or failed attempts to do so (Event ID 4766). The SID History attribute can be abused to gain unauthorized access and escalate privileges across domain boundaries by injecting well-known or administrative SIDs, a technique known as SID-History Injection.
Page 49 of 401