Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the use of known named pipes associated with Cobalt Strike post-exploitation frameworks, often used for inter-process communication during beaconing or lateral movement.
Detects suspicious device registrations to Azure AD's Device Registration Service (DRS) using the device code flow. This rule identifies registrations where the device OS attributes are suspicious (e.g., version 0.0.0.0) or where a non-Windows OS claims a Windows identity, potentially indicating an adversary attempting to bypass conditional access policies or gain persistent access.
Detects suspicious execution of Node.js processes initiated by VS Code (or Cursor) that appear to be running JavaScript payloads disguised as font files (.woff2) or other suspicious assets. It also monitors for the creation or modification of '.vscode/tasks.json' files by package managers or source control tools, which could indicate the configuration of malicious 'folderOpen' tasks used for persistence or automated execution upon workspace opening.
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
Detects the creation of a Windows scheduled task that attempts to execute a VMware-related binary (vmwared.exe) under the guise of 'MicrosoftEdgeUpdate' on system logon with the highest privileges. This behavior is indicative of a persistence mechanism attempt.
Detects Millenium RAT establishing persistence by creating a Registry Run key (MsEdgeUpdate) that executes a binary named svchost.exe from an obfuscated AppData subdirectory, or identifies general persistence attempts by creating Registry Run keys pointing to executables within user-writable AppData or Temp directories.
Detects the execution of 'JuicyPotato', a known tool used for local privilege escalation on Windows systems by abusing the BITS service or DCOM to achieve arbitrary process execution as SYSTEM.
This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Detects the creation or modification of Windows Registry Run keys that point to files within user-writable directories (AppData or Temp). This behavior is correlated with preceding execution of script interpreters (PowerShell, WScript, CScript, MSHTA, Node, or CMD) on the same endpoint, which is a common pattern for dropper or RAT installation stages.
Detects suspicious API call sequences indicative of process injection into the 'svchost.exe' system process. The rule monitors for a combination of memory manipulation and thread execution APIs, such as 'ZwWriteVirtualMemory', 'NtDuplicateObject', 'VirtualAllocEx', and 'CreateRemoteThread', when initiated by processes other than legitimate Windows system processes. This is a common indicator of unauthorized code execution or lateral movement.
Detects the presence of a specific global event object 'Global\ShitSetupOn26126k' used as a mutex or single-instance check by the DragonReturn malware dropper.
Detects host-level configuration changes indicative of preparing a system for the CVE-2026-46331 pedit COW exploit. This includes enabling unprivileged user namespaces via sysctl and disabling security mitigations or removing the act_pedit kernel module.
User Added to an Administrator's Azure AD Role
Search Common EventCodes (EventID’s) for Suspicious Behavior
Detects instances where WinRAR.exe is observed writing potentially malicious script or link files (.hta, .vbs, .js, .ps1, .lnk) into the Windows Startup folder. This pattern is indicative of exploitation of CVE-2025-8088, a path traversal vulnerability in WinRAR often leveraged by the Gamaredon group to establish persistence.
This rule detects file creation, modification, or module loading events involving specific DLL files ('msvcr90.dll' or '7z.dll') from a suspicious directory path ('Traiolx Custom Utils'). This behavior is commonly associated with DLL side-loading, where an adversary places malicious or renamed legitimate DLLs into a specific directory to hijack execution flow.
This rule detects two common persistence techniques: the modification of Windows Registry Run keys with paths referencing temporary or application data directories, and the creation of autorun.inf files on removable or non-system drives to facilitate potential code execution upon media insertion.
Detects activity indicative of container escape attempts, specifically identifying the use of 'docker cp' with path traversal sequences to manipulate host files, or the unauthorized execution of shells and utilities directly spawned by the container runtime daemon (dockerd). It also monitors for execution patterns associated with known container escape proof-of-concept scripts.
Detects potential container breakout or privilege escalation attempts originating from Gitea act-runner processes. The rule monitors for the execution of containers with dangerous security configurations (e.g., host PID/IPC namespace, privileged capabilities, disabled security modules) or the use of nsenter to break out of a container into the host environment.
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Page 50 of 401