Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects cross-process activity (OpenProcess or CreateRemoteThread) targeting critical system processes (svchost.exe, explorer.exe, or rundll32.exe) from suspicious or unexpected parent processes. The rule aggregates multiple events over a short time window to reduce noise and applies a risk-based scoring system based on the injector file location.
Detects anomalous process creation where svchost.exe or explorer.exe is spawned by a process other than standard system parents (e.g., services.exe, wininit.exe). This behavior is consistent with SystemBC (Coroxy) reflective DLL loading or process hollowing, where malicious code is injected into core Windows processes to evade detection.
Detects anomalous child process execution spawned by the AnyDesk service, indicative of exploitation of the adprinterpipe named pipe. This vulnerability involves a low-privileged attacker supplying malicious IStream bytes to the service to trigger code execution in the SYSTEM context.
Detects a suspicious sequence of events where a Gitea act_runner process spawns a container with dangerous namespace or capability flags (e.g., --pid=host, --cap-add=ALL) followed by the execution of 'nsenter' in the same environment, indicating an attempt to escape the container to the host.
Detects instances where ImageMagick (magick.exe) or legacy conversion tools (convert.exe) spawn Ghostscript executables (gswin64c.exe, gswin32c.exe) from non-standard or user-writable directories (e.g., Temp, AppData, Public). This pattern is indicative of a delegate path hijacking attack, where an adversary attempts to execute arbitrary code by forcing a vulnerable application to load a malicious Ghostscript binary instead of the legitimate, installed version.
This rule detects persistence mechanisms associated with BeepRAT (a DcRAT variant) by correlating the creation of suspicious files (DLL, EXE, or C files) in user-writable directories (e.g., AppData, Temp, ProgramData) with the subsequent execution of 'schtasks.exe /create'. It specifically monitors for task creation commands referencing these suspicious paths, known loader binaries (rundll32, regsvr32, tcc.exe), or specific naming conventions like 'WindowsUpdateTempFileCleanUp'.
Detects local privilege escalation attempts targeting the SystemInformer PhSvc helper service. The technique involves abusing the trust check within the PhSvc service by using rundll32.exe to connect to the SiSvcApiPort ALPC port and invoke privileged helper APIs, such as PhSvcApiCreateProcessIgnoreIfeoDebugger, to spawn processes with elevated privileges.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new user account with administrator privileges (group 4). This rule identifies when an account with limited management permissions exploits the ACP to assign a new user to the administrator group, effectively bypassing intended permission restrictions.
Detects the use of the 'cp' command within a Docker container context to access files outside the current working directory, identified by the usage of parent directory traversal (..). This pattern is often associated with container escape attempts or unauthorized file access within a containerized environment.
This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.
This rule detects persistence mechanisms associated with the SHARDLOADER threat activity, specifically monitoring for the creation of suspicious Registry 'Run' keys using the 'MediumNetMonIt' value or via scheduled task creation referencing known staging paths under 'C:\ProgramData\IDM\logs\'.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
This rule detects potential persistence mechanisms by monitoring for the creation of specific, suspicious scheduled tasks or the modification of registry values. The patterns flagged include known indicators of malicious activity such as specific directory paths (e.g., \ProgramData\IDM\logs\ or \Microsoft\VaultCache\) and known malicious file names associated with unauthorized background execution.
This rule detects the creation of a new Windows service where the executable path is located in suspicious directories (e.g., ProgramData, AppData, Temp, Users Public). It correlates the service installation event (using sc.exe) with the subsequent execution of the binary by services.exe within a two-hour window, identifying potential persistence mechanisms or malicious service-based execution.
Detects rapid post-exploitation activity where a developer's workstation, upon executing VS Code (Code.exe), initiates outbound network connections to major cloud service or CI/CD provider APIs (GitHub, AWS, Azure, GCP) within 60 minutes. This behavior is indicative of the Lazarus Group 'Contagious Interview' campaign, where stolen credentials from developer environments are used to pivot into cloud infrastructure or CI/CD pipelines.
This rule detects potential DLL side-loading and file staging activity by monitoring for the execution of specific suspicious binaries or the loading of known malicious DLLs from non-standard or staging directories like C:\Users\Public\Documents\ or C:\ProgramData\IDM\logs\. The rule flags activity associated with loaders like SHARDLOADER, ZOHOMURK, and MINIRECON.
Detects malicious use of PowerShell cmdlets to modify Group Policy Objects (GPOs) for ransomware distribution. The rule monitors for execution of GPO management cmdlets in conjunction with specific ransomware indicators, such as disabling Windows Defender real-time monitoring, modifying GPO machine extension names, or targeting SYSVOL/NETLOGON network shares.
Detects the creation of Windows services where the executable path is located in suspicious or volatile directories such as ProgramData, Temp, or AppData. This behavior is indicative of malware, specifically the The Gentlemen RaaS group, establishing persistence or deploying malicious components on a compromised system.
This rule detects multiple distinct attempts to tamper with security products on a host. It identifies processes attempting to stop security-related services (via sc.exe or net.exe), processes attempting to kill security-related applications (via taskkill.exe), modifications to Windows Defender registry keys, or the use of PowerShell Set-MpPreference to disable security features. The rule triggers when two or more of these evasion events or types occur within a 5-minute window on the same host.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
This rule detects anomalous or risky sign-in events for user accounts that have recently configured an active out-of-office (OOF) auto-reply. An attacker may leverage a user's known absence to gain access to their email or other corporate resources using compromised credentials, as the user is less likely to notice suspicious account activity while away.
Page 64 of 401