Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects suspicious cross-process activity, such as process hollowing, where an unsigned or unusually located process (e.g., in AppData, Temp, or Downloads) attempts to inject code into legitimate Windows system processes like svchost.exe or explorer.exe.
This rule monitors Windows Sysmon Event ID 10 (ProcessAccess) for suspicious activity where the CallTrace indicates the use of direct syscalls (bypassing standard Win32 DLL chain) or anomalous execution paths while targeting high-value processes such as security agents, system services, and critical infrastructure (e.g., lsass.exe, svchost.exe).
Detects registry modifications (specifically key creation or value setting) initiated by QEMU system binaries or their child processes, focusing on paths commonly associated with persistence (Run keys) or general software configuration storage.
Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects the creation of scheduled tasks (via schtasks.exe or at.exe) that include command-line arguments referencing virtualization artifacts (qemu, .qcow2, .vmdk, TPMProfiler) or specific database/dll files (vault.db, bisrv.dll). This pattern is often indicative of persistence mechanisms used by malware or threat actors to manage virtualized environments, exfiltrate data, or deploy components.
Detects suspicious activities related to the execution of qemu-system-x86_64, including scheduled task creation referencing 'TPMProfiler', execution under the SYSTEM account, and outbound network communication to known malicious IP addresses on specific ports (22, 32567, 22022).
This rule detects potential lateral movement by identifying users who, within a short timeframe (90 seconds) of their first recorded network logon (EventID 4624, Logon Type 3), perform suspicious follow-up activities such as explicit credentials usage (4648), network share access (5140), or remote service installation (7045).
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
This rule detects successful authentication attempts directed at network devices from sources not explicitly marked as authorized management systems. It identifies users or systems that are not recognized service accounts authenticating against network infrastructure and flags activity that involves multiple unique destination targets as high risk.
This rule detects potential lateral movement by identifying users who, within a short timeframe (90 seconds) of their first recorded network logon (EventID 4624, Logon Type 3), perform suspicious follow-up activities such as explicit credentials usage (4648), network share access (5140), or remote service installation (7045).
Detects the creation of scheduled tasks by decompression utilities or Office applications. This behavior is indicative of a dropper technique where malicious artifacts extracted from archives or spawned by Office documents establish persistence. The rule specifically monitors schtasks.exe command lines that target user-writable directories or involve rundll32-based execution, commonly used by the Obsidian Sandstorm/SilverGorilla threat actor activity.
This rule detects instances where a process attempts to open a handle to itself with high-privilege access rights (e.g., PROCESS_ALL_ACCESS, PROCESS_VM_WRITE, PROCESS_VM_OPERATION). This behavior is often indicative of self-injection, a technique used by malicious code to modify its own memory space or inject shellcode, evading detection and bypassing certain security controls.
This rule detects potential User Account Control (UAC) bypass attempts involving eventvwr.exe. It monitors for three suspicious patterns: eventvwr.exe spawning a child process that is not mmc.exe, modification of the HKCU\Software\Classes\mscfile\shell\open\command registry key used for hijacking file associations, and eventvwr.exe being launched from a non-standard system directory.
This rule monitors for indicators of Impacket toolset usage across multiple data sources, including named pipe access (Event 5145), service creation (Event 7045), scheduled task creation (Event 4698), and process execution (Event 1). It flags suspicious activity associated with modules like secretsdump, wmiexec, psexec, and smbexec, aggregating findings by source host and user to evaluate the breadth of potential unauthorized activity.
Detects suspicious repository content updates, such as modifications to package files, workflow configurations, or README files, and activities involving automated user IDs like 'dependabot' or 'github-actions' that may indicate compromised CI/CD credentials or unauthorized repository defacement.
Detects suspicious 'npm publish' or 'npm login' commands executed as child processes of 'node' or 'npm'. This pattern indicates programmatic execution from within package install hooks (such as preinstall or postinstall scripts) instead of manual developer interaction, a behavior characteristic of malicious npm supply chain attacks (e.g., IronWorm) aiming to trojanize packages using stolen tokens.
Detects User Account Control (UAC) bypass attempts where eventvwr.exe is abused via registry modification of HKCU\Software\Classes\mscfile\shell\open\command. The rule identifies suspicious child processes spawned by eventvwr.exe (such as mmc.exe, BQT.exe, or start.exe) that deviate from standard behavior, as observed in BQTLock ransomware activity.
Detects cases where a user privilege is granted (EventCode 4717) and subsequently revoked (EventCode 4718) within a 60-minute window. This behavior often indicates transient privilege abuse, where an attacker grants themselves temporary elevated rights to perform an action and then revokes them to evade detection or minimize their footprint.
This rule detects the installation of a new Windows service by monitoring Security Event IDs 4697 and 601. It extracts details about the service name, file path, and account used. The rule flags services that have suspicious binary paths, such as those within user-writable directories (Temp, AppData, Downloads) or paths containing common living-off-the-land binaries, which may indicate persistence or the loading of malicious drivers.
Detects cases where a user privilege is granted (EventCode 4717) and subsequently revoked (EventCode 4718) within a 60-minute window. This behavior often indicates transient privilege abuse, where an attacker grants themselves temporary elevated rights to perform an action and then revokes them to evade detection or minimize their footprint.
This rule detects the creation of scheduled tasks using 'schtasks.exe' or PowerShell's 'Register-ScheduledTask' cmdlet. The detection focuses on command lines that include indicators of suspicious activity, such as encoded commands, hidden window styles, or placement in temporary or application data directories, specifically when the initiating process is not a signed Microsoft binary.
Page 56 of 401