Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects modifications to COM object registration keys under HKEY_CURRENT_USER (HKCU) which can be used to hijack COM objects for persistence. The rule monitors for the creation or modification of InProcServer32 or LocalServer32 values, while excluding common system paths to reduce noise.
Detects when a single user account performs 3 or more Privileged Identity Management (PIM) role activations within a 30-minute window. This behavior may indicate an attacker who has compromised a privileged account and is rapidly assuming multiple roles to perform lateral movement or privilege escalation.
Detects network requests to Microsoft Graph API endpoints related to MFA method configuration. This pattern often indicates an adversary attempting to add, modify, or register new MFA authentication methods (such as phone-based methods) for an account to facilitate persistence or bypass security controls.
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
Detects the creation of user accounts or modifications to sensitive groups (Event IDs 4720, 4728, 4732, 4756) where the account name matches naming conventions typically associated with backup service accounts or elevated administrative roles (e.g., prefix 'backup_', 'bkp_' or suffix '_da', '_ea'). This activity can indicate an attacker attempting to establish persistence or escalate privileges via compromised or newly created accounts.
Detects the creation or modification of Windows Registry keys or values within the 'CurrentControlSet\Services' path that refer to 'rustdesk'. This typically indicates the installation or configuration of the RustDesk remote access tool as a system service, which may be unauthorized or used for persistence by an adversary.
Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.
Detects persistence via registry modification commonly associated with RomCom adversary activity (e.g., Mythic, SnipBot, MeltingClaw) post-CVE-2025-8088 exploitation.
Detects indicators of the MYRA Linux RAT, including process masquerading as systemd-userdbd, persistent modifications to system locations like /etc/profile.d/ and /usr/local/lib/, and malicious cron scheduling, typically originating from a Node.js process.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
Detects Remcos RAT masquerading as explorer.exe by launching legitimate Internet Explorer browser components (iexplore.exe, ieinstal.exe, or ielowutil.exe) in a suspended state. This activity is indicative of process hollowing or PEB modification used by Remcos to inject malicious code into a seemingly legitimate process while evading detection.
Detects behavior indicative of the Remcos RAT injecting its code into legitimate Windows processes (such as iexplore.exe, ieinstal.exe, ielowutil.exe, svchost.exe, or explorer.exe). The rule identifies this by monitoring for a process matching the Remcos naming convention that launches a secondary process in a suspended state, followed by cross-process activity that deviates from standard system behavior.
Detects persistence mechanisms associated with the MYRA Linux RAT, including the use of LD_PRELOAD to load a malicious shared library from a hidden path, persistent shell profile modification via /etc/profile.d/.sh.local, and process masquerading as systemd-userdbd. This rule is linked to the Polymarket Trap campaign involving malicious npm packages.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
This rule detects the creation or modification of user accounts on Windows systems by monitoring Security Event IDs 4741 (A security-enabled local group was created) and 4742 (A computer account was changed). It summarizes the count of such changes per hour by the subject user name, which can help identify unusual or excessive account management activities.
Detects the successful creation or update of an Azure API Management Service. This activity could indicate legitimate administrative actions or, if unexpected, potential unauthorized access or privilege escalation within the Azure environment. Monitoring these events can help identify suspicious configuration changes or resource provisioning by malicious actors.
Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.
This rule detects instances where a Node.js process spawns or executes the systemd-userdbd utility. systemd-userdbd is a system daemon used for user/group database lookups. Execution of this component by a user-land Node.js application is highly atypical and may indicate a compromise where an attacker is abusing system binaries for persistence, privilege escalation, or reconnaissance.
This rule detects suspicious command-line activity indicative of potential token impersonation or theft. It specifically looks for the keywords 'token' or 'impersonate' within process creation command lines (EventID 4688) and triggers an alert if these keywords appear 3 or more times within an hour on the same computer by the same account. This could indicate an adversary attempting to manipulate access tokens to elevate privileges or operate under a different security context.
This rule detects when a user adds mailbox permissions to three or more mailboxes within a one-hour window in Exchange Online. This behavior can indicate an adversary attempting to gain persistent access to multiple mailboxes, often for data exfiltration or further compromise.
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts'. The rule identifies suspicious SSH activity by looking for 'sshpass' execution or multiple 'ssh' commands with specific PeopleSoft-related usernames, potentially preceded by commands to read '/etc/hosts'.
Page 61 of 401