Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects sign-in events using the device code authentication flow (OAuth 2.0 device authorization grant) where the originating IP address is external to the organization's private network. This flow is often abused by attackers to bypass traditional MFA or interact with headless environments via common HTTP client libraries like Python requests, Go-http, or Axios.
Detects modifications to Windows Registry keys responsible for UAC behavior (ConsentPromptBehaviorAdmin and EnableLUA) performed by common command-line utilities. Such modifications can be indicative of attempts to disable or weaken User Account Control (UAC) to facilitate privilege escalation or defense evasion.
Detects the creation or modification of a specific registry Run key entry named 'Financeiro' in the Windows 'CurrentVersion\Run' hive. Such registry keys are a common technique used by malware or unauthorized scripts to establish persistence, ensuring code execution upon user logon.
This rule detects modifications to Windows Registry Run keys, specifically looking for a registry value named 'Financeiro', which is a common persistence mechanism used to execute malicious programs automatically upon user logon.
This rule monitors for additions of users to highly sensitive Active Directory groups, such as Domain Admins or Enterprise Admins, by tracking specific Windows security events (4728, 4732, 4756). Unauthorized membership changes in these groups are a classic indicator of privilege escalation or persistence maintenance by an adversary.
Detects modifications to computer or user accounts in Active Directory where the 'Trusted for Delegation' flag is enabled. Enabling unconstrained delegation allows a compromised account to request and cache Ticket Granting Tickets (TGTs) for any user authenticating to the service, enabling potential privilege escalation and lateral movement.
Detects modifications to computer or user accounts in Active Directory where the 'Trusted for Delegation' flag is enabled. Enabling unconstrained delegation allows a compromised account to request and cache Ticket Granting Tickets (TGTs) for any user authenticating to the service, enabling potential privilege escalation and lateral movement.
Detects persistence mechanisms associated with the MYRA Linux RAT, including malicious library injection via LD_PRELOAD using /usr/local/lib/.libcache.so, creation of persistence scripts in /etc/profile.d/, and process masquerading where a process executes as 'systemd-userdbd' but is not launched by the legitimate systemd manager.
Detects the transmission of a Portable Executable (PE) file header ('MZ' and 'PE' magic bytes) within an HTTP response stream, which is a common indicator of a staged file download or process injection payload being delivered over the network.
Detects modifications to COM object InProcServer32 registry keys within the user's registry hive (HKEY_USERS). Attackers often hijack COM objects to achieve persistence by pointing them to malicious DLLs or OCX files. This rule specifically filters out common legitimate paths (Windows directories, Program Files) and known installers to reduce noise.
Detects the creation or modification of .vscode/tasks.json files that contain configurations designed to execute tasks automatically upon opening a folder in VS Code, specifically utilizing 'runOn': 'folderOpen' combined with visibility-hiding attributes such as 'reveal': 'never' and 'echo': false. This pattern is commonly associated with supply chain attacks where malicious payloads are hidden within project configuration files.
Detects the creation or modification of a Windows service named 'MixedSvc' or containing 'Mixed Reality' in the command line where the binPath points to a non-System32 directory or the Windows Media Player folder, which is indicative of potential service hijacking or persistence techniques.
Detects the execution of known exploit-related binaries or command lines, including references to specific exploit source files (e.g., 'pedit_cow_demo', 'packet_edit_meme'), CVE identifiers, or specific traffic control (tc) configurations potentially used in exploitation activities.
Detects macOS.Gaslight DPRK-aligned implant registering a LaunchAgent plist using the com.apple.system.services.activity label to masquerade within Apple's com.apple.* namespace for persistence. Key behavioral indicators include file writes to ~/Library/LaunchAgents with the spoofed label and use of __NSGetExecutablePath for binary path resolution.
This rule detects when sensitive administrative roles are assigned directly to users in Microsoft Entra ID (formerly Azure AD) without utilizing the Privileged Identity Management (PIM) service. Direct assignment of these roles bypasses the security controls and JIT (Just-In-Time) access workflows enforced by PIM, potentially indicating unauthorized privilege escalation or a misconfiguration.
Detects when an application or service principal is assigned an app role containing sensitive permissions in Azure AD/Microsoft Entra ID. Such assignments can grant an application elevated access to mail, directory, or user management, which is a common tactic for persistence and privilege escalation in cloud environments.
Detects potential UAC bypass activity involving the hijacking of the Event Viewer (eventvwr.exe) COM object. The rule monitors for registry modifications to the 'HKCU\Software\Classes\mscfile\shell\open\command' key, followed by the execution of 'eventvwr.exe' by a suspicious parent process, indicating an attempt to elevate privileges to perform arbitrary command execution.
Detects unprivileged processes creating a new user namespace (CLONE_NEWUSER) followed by a network namespace (CLONE_NEWNET) and modifying procfs mapping files (uid_map, gid_map). This sequence is characteristic of the exploitation staging phase for CVE-2026-43503 (DirtyClone) to gain CAP_NET_ADMIN privileges and overwrite the page cache.
Detects a suspicious sequence of events on Linux where a non-root process creates a user namespace followed within 5 minutes by either network XFRM policy manipulation or the loading of specific kernel modules (esp4, esp6, or rxrpc). This behavior is characteristic of an attempt to bypass kernel security restrictions or establish unauthorized encrypted tunnels.
Detects application log patterns indicative of a memory leak exploitation attempt against vLLM using the Python Imaging Library (PIL). This behavior is associated with an ASLR bypass technique leveraging BytesIO object manipulation, a prerequisite for a subsequent heap overflow vulnerability.
Detects the addition of secrets or certificates to Azure service principals during non-business hours (before 7 AM or after 7 PM, or on weekends). This behavior may indicate an adversary attempting to establish persistence in a cloud environment by adding their own credentials to an existing service principal.
Page 60 of 401