Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
Detects the use of the 'docker cp' command with suspicious path traversal characters or known PoC artifacts in the destination parameter. This behavior is indicative of an attempt to exploit path traversal vulnerabilities in the Docker daemon (such as those allowing container escape) by writing files outside the container's intended scope onto the host filesystem.
Detects Gitea act_runner spawning Docker containers with dangerous runtime flags (e.g., --pid=host, --privileged, --cap-add=ALL) that facilitate host namespace escape. This activity is indicative of exploitation of CVE-2026-20896, where malicious CI/CD workflow YAML files inject these options to break out of the container sandbox and access the host filesystem.
Detects AnyDesk spawning suspicious child processes (cmd, powershell, etc.) indicative of local privilege escalation via the AnyDesk printer COM object impersonation vulnerability. This technique involves an attacker-controlled process communicating with the AnyDesk service's named pipe (adprinterpipe) to trigger code execution in the context of the LocalSystem AnyDesk service.
This rule detects a two-stage DLL sideloading chain associated with Mustang Panda campaigns, specifically utilizing the SHARDLOADER and ZOHOMURK malware components. It monitors for the loading of malicious DLLs ('SolidPDFCreator.dll', 'ctxmui.dll') by specific binaries, as well as the execution of associated staging processes and file creation events in public directories.
Detects the creation of scheduled tasks using schtasks.exe or at.exe where the command line contains suspicious indicators such as execution from AppData/Temp directories, use of LOLBins (rundll32, regsvr32, powershell), encoded commands, or suspicious command-line patterns, specifically when the initiating process is not signed by Microsoft.
Detects malicious activities associated with The Gentlemen RaaS group, specifically targeting GPO modifications to distribute ransomware, disable Windows Defender Real-time Monitoring, and deploy persistence mechanisms via scheduled tasks in SYSVOL or NETLOGON paths.
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects the creation of scheduled tasks by known Mustang Panda DLL sideloading hosts, specifically Solid PDF Creator or Citrix Receiver components. This rule identifies persistence mechanisms likely established during the post-compromise phase of espionage operations.
Detects the creation of scheduled tasks using schtasks.exe where the task involves paths often associated with user-writable directories (ProgramData, AppData, Temp) and specific suspicious keywords. This behavior is common for adversaries seeking persistence by scheduling execution of potentially malicious payloads located in non-standard or user-writable locations.
Detects the creation or modification of Windows Registry Run keys with values associated with known potentially unwanted programs, malware, or suspicious persistence attempts, excluding known legitimate installer processes.
Detects suspicious modifications to Group Policy Objects (GPOs) using PowerShell cmdlets, including references to sensitive paths like SYSVOL/NETLOGON or suspicious script files, as well as the execution of 'gpupdate /force' from non-standard shell processes. These behaviors are often indicative of GPO abuse for persistence, lateral movement, or defense evasion.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Detects the creation of a scheduled task named 'RageGuard' using the Windows schtasks.exe utility. This behavior is indicative of the TrymeLocker malware attempting to maintain persistence on a compromised system by executing with highest privileges upon user logon.
Detects modifications to the 'StubPath' registry value within the 'Active Setup\Installed Components' registry hive. Adversaries use this mechanism to achieve persistence by forcing the execution of arbitrary code when a user logs in.
This rule detects potential persistence mechanisms on Windows systems where a registry run key is configured to launch an executable associated with the RageCore malware or win_guard utility. It monitors for the creation or modification of registry entries within the Windows Run registry keys that reference these specific strings.
Detects CldFlt.sys driver load activity coinciding with SyncRootManager registry modifications by non-standard processes, indicating potential RedSun exploitation of CVE-2026-41091 via the Cloud Files filter driver path. This correlation suggests an attempt to establish persistence or escalate privileges by manipulating system components related to cloud file synchronization.
Detects creation of scheduled tasks for execution or persistence
Detects assignment of high-privileged cloud admin roles for persistence
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Page 51 of 401