Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of a /bin/sh root shell initiated by /bin/su where the parent process indicates a non-root context. This pattern is characteristic of CVE-2026-46331, where an attacker exploits the page cache (pedit COW) to inject shellcode into the in-memory cached /bin/su binary, effectively gaining root privileges without on-disk modification.
Detects evidence of CVE-2026-43503 (DirtyClone) exploitation, where an unprivileged user attempts to gain root access by corrupting the in-memory page cache of /usr/bin/su. The detection monitors for suspicious invocation of 'su -c /bin/sh' by non-root users and the subsequent spawning of root shells from an unprivileged parent process.
Detects DcRAT malware attempting to perform fileless process injection into svchost.exe from the 'Mixed Reality.exe' process. This behavior leverages NT API calls such as ZwWriteVirtualMemory and NtDuplicateObject, a technique identified in Operation DragonReturn targeting Indian infrastructure.
Detects Millenium RAT payloads that masquerade as legitimate Windows processes (such as MsEdgeUpdate or svchost.exe) by running from temporary directories (AppData or Temp). The rule also monitors for associated persistence mechanisms via HKCU Run registry keys.
Detects a specific AMSI bypass technique associated with Operation DragonReturn, where the process patches amsi.dll memory using VirtualProtect after dynamically locating the function with GetModuleHandleA and GetProcAddress.
Detects unauthorized persistence established by the TONResolver RAT, where the node.exe process creates or modifies an autorun registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The registry value points to an executable located within the user's AppData\Local\Nodejs directory, a common path utilized by the malware for persistence.
Detects malicious activity associated with the TONResolver RAT, specifically the initiation of a system reconnaissance beacon containing host information and the establishment of registry-based persistence. The rule monitors for a node.exe process residing in a specific AppData path performing network communication and registry modifications to the HKCU Run key.
Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.
Detects unauthorized process injection attempts (specifically ZwWriteVirtualMemory, NtWriteVirtualMemory, WriteProcessMemory, NtDuplicateObject, and ZwDuplicateObject) into 'svchost.exe' from suspicious, non-system parent processes. This detection focuses on behavior associated with DcRAT and Operation DragonReturn, using risk scoring based on file paths and specific known malicious file names.
Detects the creation of persistence via a malicious Windows service named 'MixedSvc' or any service pointing to 'Mixed Reality.exe' located within 'C:\Program Files\Windows Media Player\'. This activity is consistent with the 'Operation DragonReturn' campaign and the 'Silver Fox' threat actor, where the 'Mixed Reality.exe' binary acts as a host for DLL-sideloading of the DcRAT backdoor.
Identifies the malicious RMM establishing persistence by creating a system service configured to auto-start the backdoor on reboot. The rule specifically looks for the 'sc.exe' utility being used to create a service with a binary path pointing to an executable within the 'AppData' directory and configured for automatic startup.
Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by identifying a high volume of Netlogon authentication requests followed by a successful login by a Domain Admin, indicating a machine account password reset attack.
Detects LCRYX ransomware activity characterized by the execution of VBScript files via wscript/cscript, followed by attempts to disable security products (Windows Defender or third-party AVs) using command-line utilities, and establishing persistence via Registry Run keys within a 10-minute window on the same host.
This rule detects modifications to the Winlogon Shell registry key or a specific 'MyStartupScript' registry Run key. These locations are commonly abused by the LCRYX ransomware to establish persistence via VBScript or script host execution. The rule monitors both EDR registry events and Sysmon event ID 13 for suspicious changes performed by script host processes or targeting these specific persistence locations.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
This rule detects potentially malicious activities related to Active Directory Certificate Services (AD CS). It identifies suspicious certificate export commands (certutil, PowerShell), non-privileged processes writing to system certificate stores, and dangerous AD CS enrollment patterns such as Subject Alternative Name (SAN) modifications, often associated with ESC1 privilege escalation techniques.
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value used by the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to establish persistence or execute malicious code by abusing the Windows SyncRootManager functionality.
Detects suspicious behavior linked to the BeepRAT malware or related tooling (tcc.exe, LuaJit.exe). It monitors for the loading of GDI32 modules by these specific processes and identifies instances where these processes perform cross-process access to sensitive Windows system processes like explorer.exe or dwm.exe, which is indicative of process injection or defense evasion techniques.
Detects evidence of the BeepRAT malware (via known file names, loader behavior, and specific command-line arguments) and attempts to tamper with security software through process termination, service modification, or the addition of Windows Defender exclusions.
Detects potential privilege escalation attempts against a MyBB forum by monitoring POST requests to administrative endpoints. Specifically, it flags session activity that includes creating new users with admin group assignments (usergroup=4) or accessing sensitive administrative modules (config, tools, style, user) from within the admin control panel.
Page 63 of 401