Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Latin American banking trojan using DLL side-loading and overlay attacks
Cloud extortion group exploiting exposed credentials and storage
Campaign converting compromised FortiGate firewalls into credential stealers
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
Banking trojan and loader using malicious Office macro delivery
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Detects the creation or modification of Windows Registry Run keys (Run/RunOnce) by processes other than those signed by Microsoft Corporation. This is a common technique used to maintain persistence by executing programs automatically upon user logon.
Detects instances where the Windows binary fodhelper.exe spawns various shell or utility processes. This behavior is a common indicator of a User Account Control (UAC) bypass attack, where the attacker leverages the auto-elevation property of fodhelper.exe to execute arbitrary commands with higher privileges.
Detects the creation of scheduled tasks using schtasks.exe where the command originates from or references the C:\ProgramData\ directory. This pattern is consistent with the SystemBC (Coroxy) malware's persistence mechanism, where a randomly named executable is staged in ProgramData and configured for execution via Task Scheduler.
Detects anomalous, high-volume file creation patterns in temp directories characterized by UUID-style filenames from non-system processes. This behavior is indicative of a multi-threaded I/O saturation technique used by the RoguePlanet exploit to create a race condition (TOCTOU) against Microsoft Defender (MsMpEng.exe).
Detects unauthorized modifications to FreeBSD init scripts located in /etc/rc.d/, /usr/local/etc/rc.d/, or /etc/rc.subr. These directories are used for system service startup. The rule specifically monitors for modifications related to the BRICKSTORM persistence mechanism, which targets these scripts to execute malicious binaries such as /usr/local/libexec/ipsec/blacklist.
This rule detects potentially malicious activity related to the cron utility, including the modification of cron-related configuration files and the execution of specific suspicious payloads (e.g., ssync.sh, blacklist). It monitors for file creation, modification, or renaming events within sensitive directories, as well as the spawning of processes by cron daemons using identified suspicious paths or command names.
Detects anomalous process execution patterns indicative of privilege escalation or persistence on Linux systems. Specifically monitors for unexpected root shell access from non-privileged service accounts (e.g., www-data, apache), abuse of sudo for modifying privileged system files via tee, and execution of binaries from world-writable directories such as /tmp or /dev/shm, which is a common behavior during exploit staging.
Detects instances where the Microsoft Defender service (MsMpEng.exe) spawns common system utilities like cmd.exe, powershell.exe, or wscript.exe running with SYSTEM integrity. This is highly anomalous as Defender should generally not be the parent process for these interactive or script execution shells.
Detects the execution of potential stealer malware (such as Yuta or Glove Stealer) packaged as a PyInstaller executable. The detection monitors for the characteristic behavior where the application unpacks its runtime environment into a _MEI* temporary directory and subsequently spawns child processes from that path, or utilizes specific naming conventions like 'winupdate.exe' within temporary or cache directories, common techniques for staging malicious payloads.
Detects Yuta/Glove Stealer malware attempting to establish persistent WMI event subscriptions for keylogging. This is identified by the execution of wmic.exe or PowerShell to register event filters, consumers, or bindings, initiated by suspicious parent processes such as winupdate.exe or processes originating from temporary/staging directories.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, specifically targeting behaviors associated with threat groups like BlackFile and Cordial Spider. The rule identifies these activities by filtering Okta SSO raw logs for specific event types related to MFA and device management, and then correlating them with known proxy ASN organizations or Okta's internal proxy flags.
Detects the Payouts King malware creating, running, or deleting specific scheduled tasks named \Mozilla\UpdateTask or \Mozilla\ElevateTask, as well as indirect execution of these tasks via cmd.exe redirection.
Detects persistence mechanisms associated with Obsidian Sandstorm activity, including scheduled task creation, registry run key modification, and startup folder file drops initiated by suspicious processes or from non-standard directories like AppData/Temp.
Page 55 of 401