Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of PowerShell (powershell.exe or pwsh.exe) containing command line arguments indicative of malicious activity, including encoded commands, memory loading, assembly loading, thread creation, or attempts to bypass AMSI (Antimalware Scan Interface). The rule specifically excludes processes signed by Microsoft to reduce false positives.
Detects the execution of the BUMSRAKETE exploit for CVE-2026-45257, which targets kTLS-RX page-cache corruption in FreeBSD to achieve local privilege escalation. The rule monitors for pre-exploitation sysctl enumeration of kernel memory management parameters and the subsequent spawning of privileged shells (su/sh) by the exploit process.
Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.
Detects various privilege escalation and reconnaissance techniques commonly associated with the 'Operation Poisson' campaign, including UAC bypass attempts, local administrator group enumeration, and administrative privilege verification triggered by script interpreters.
Detects malicious activity associated with the Miasma/MYRA infostealer campaign targeting DeFi developers. The rule monitors npm lifecycle scripts (postinstall/preinstall) for suspicious execution, C2 communication with known malicious domains, unauthorized access to browser-based credential storage, and persistence attempts via LD_PRELOAD on Linux environments.
This rule detects reconnaissance activity on FreeBSD systems by monitoring the execution of 'sysctl', 'uname', 'freebsd-version', and 'pkg' to query sensitive kernel parameters and system version information. Specifically, it flags queries related to CVE-2026-45257 (BUMSRAKETE), such as 'kern.ipc.mb_use_ext_pgs' and 'kern.tls.enable'. The rule differentiates risk levels based on the combination of targeted kernel parameter checks and system version enumeration.
Detects MYRA Linux RAT persistence mechanisms. The rule monitors for the creation of cron jobs scheduled to run every 13 minutes and the creation of a profile initialization script at /etc/profile.d/.sh.local, which is a common technique for ensuring code execution upon user shell session initialization.
This rule detects potentially malicious activity related to cron job scheduling. It monitors for three distinct stages: (1) direct modification of crontab files or directories using common shell utilities, (2) suspicious file write operations to critical cron configuration paths, and (3) execution of shell scripts or binaries from unusual directories (e.g., /tmp, /dev/shm) where the parent process is a cron utility.
Detects suspicious kernel-level activity following a potential privilege escalation event on Linux systems. The rule monitors for unauthorized kernel module loading (via non-standard paths) or direct write access to /dev/kmem, which is indicative of rootkit installation or kernel-level memory manipulation.
Detects the loading of system drivers (.sys files) that are either unsigned or have an invalid digital signature. The rule excludes drivers loaded from common Windows system directories to minimize noise. This behavior is a common indicator of rootkit installation or the use of vulnerable drivers for kernel-mode exploitation.
Detects the creation of Windows Scheduled Tasks using either 'schtasks.exe' or 'powershell.exe' (via 'Register-ScheduledTask') with specific persistence flags, such as 'ONLOGON', 'ONSTART', 'SYSTEM' privileges, or 'HighestAvailable' execution levels. This behavior is commonly used by adversaries for persistence or privilege escalation.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
This rule detects potential persistence mechanisms related to browser extensions. It looks for processes launching Chrome or Edge with the '--load-extension' command-line argument, which can be used to load unpacked extensions. Additionally, it monitors registry modifications to 'ExtensionInstallForcelist' that contain 'http' or 'crx', indicating a forced installation of an extension, potentially from a remote source or a local file.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects named pipe activity with remote access enabled, initiated by JsonVMAccessExtension.exe running as SYSTEM. This may indicate abuse of the Azure VM Access Extension for unauthorized remote access.
This rule detects potential lateral movement activities by monitoring for the execution of 'psexec', 'wmiexec', or 'schtasks' commands within a short timeframe on the same computer. A count of 2 or more such command executions within an hour is flagged as suspicious, indicating potential adversary activity.
This rule detects the creation of a new Windows service (EventID 7045) where the service executable path contains both 'System32' and 'svchost', and the service description is either empty or contains 'Network'. This combination of characteristics can indicate the installation of a malicious service, potentially a backdoor or trojan, attempting to masquerade as a legitimate system service.
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
This rule detects unusual logon activity for service accounts. It identifies service accounts by looking for a dollar sign ($) at the end of the username. The rule then counts logons, unique IP addresses, and unique computers for these service accounts within one-hour bins. An alert is triggered if a service account has 10 or more logons or logs in from 5 or more unique IP addresses within that hour, indicating potential abuse or compromise.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
Page 57 of 401