Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the modification of the 'Debugger' registry value for 'agntsvc.exe' under the Image File Execution Options (IFEO) registry key. This technique is often used by adversaries for persistence or to intercept and manipulate process execution by forcing a specified program (in this case, 'Systray.exe') to run when 'agntsvc.exe' starts.
Detects processes running at High or System integrity levels that correlate with the creation of specific file artifacts known to be associated with VILE ransomware. The rule monitors for potential privilege escalation or token manipulation indicative of the ransomware's attempt to gain necessary permissions for encryption operations.
Detects the loading or execution of the Grixba infostealer payload 'inf_g.dll' or processes executing from the known Grixba RDP drop path located at 'C:\Users\Public\Music\'. Grixba malware, associated with the Play ransomware group, often disguises its components to appear like legitimate software (e.g., SentinelOne). The rule filters out legitimate module loads occurring from authorized SentinelOne installation paths to reduce noise.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP). The rule identifies HTTP POST requests, likely generated by a limited-privilege account, that attempt to create a new user with Administrator permissions (gid=4) or modify an existing user's group assignment to the Administrator group, bypassing standard ACP permission controls.
This rule detects persistent Microsoft 365 access established by an attacker using OAuth refresh tokens, typically following a device_code phishing attack. It correlates three key events: initial device_code sign-ins from non-compliant or non-managed devices, the subsequent consent to a new OAuth application (likely attacker-controlled) from the same user and within a short timeframe, and finally, Microsoft Graph mail API access originating from that newly registered application. This sequence indicates an adversary has successfully phished a user, gained consent for a malicious application, and is now using it to access the user's mailbox data.
This rule detects potential MFA bypass via stolen session cookies by identifying successful single-factor authentications from new or unmanaged/non-compliant devices, especially when originating from a new geographical location for the user or exhibiting medium/high sign-in risk. It correlates impossible travel, new device, and lack of MDM/EDR compliance signals.
This rule detects potentially suspicious AWS API activity by identifying IAM identities that perform high-privilege operations or use developer-oriented user agents (e.g., boto3, python-requests) from multiple distinct IP addresses within a one-hour window. It calculates a risk score based on the combination of source IP diversity, developer tool usage, and the presence of sensitive API calls such as CreateUser, CreateAccessKey, RunInstances, and AssumeRole.
Detects UAC bypass abuse of eventvwr.exe (Event Viewer) used by Remcos RAT to silently escalate privileges. eventvwr.exe is an auto-elevate COM-based binary; malware spawns it as a child process to gain elevated execution without a UAC prompt. The rule filters out legitimate parent processes like explorer.exe, mmc.exe, taskmgr.exe, and SearchProtocolHost.exe, as well as processes originating from standard Windows system directories.
Detects the creation of scheduled tasks using the schtasks utility that masquerade as legitimate update services (MicrosoftEdgeUpdate or GoogleUpdaterTaskSystem). These tasks are configured to run at logon with highest privileges, specifically aiming to persist the TinyRCT backdoor (associated with files such as vmwared.exe or vmtools.exe) in ProgramData directories.
Detects persistence mechanisms used by TonRAT and PureRAT, such as the Photo ZIP hospitality campaign, where registry Run or RunOnce keys are modified to execute malicious node.exe, .js, or .cmd files residing in user-writable directories like AppData, ProgramData, or Temp.
This rule detects potential exploitation of the DirtyClone vulnerability (CVE-2026-43503) by correlating prerequisites (XFRM state/policy creation, specific kernel module loading, or namespace manipulation) with a subsequent local privilege escalation where an unprivileged process spawns a root shell using 'su'.
Detects activities related to the compilation and execution of the DirtyClone PoC exploit (CVE-2026-43503) on Linux systems, including compilation from source, direct execution of the binary, and permission modifications on binaries within world-writable directories.
Detects the creation of WMI Event Subscriptions using wmic.exe or scrcons.exe. Adversaries can use WMI event subscriptions to achieve persistence by executing malicious code when a specific event occurs, such as system boot or user logon.
Detects a process running as NT AUTHORITY\SYSTEM that was spawned by a parent process not belonging to known legitimate SYSTEM-spawning Windows components. This behavioral pattern is a strong indicator of local privilege escalation (LPE), consistent with techniques such as CVE-2026-41091 (RedSun) and similar LPE exploits.
Detects successful sign-ins using legacy authentication protocols (e.g., IMAP, POP3, SMTP AUTH, ROPC) for user accounts that are in scope of a Conditional Access policy requiring multi-factor authentication (MFA). Legacy protocols do not support modern authentication flows, effectively bypassing configured MFA requirements and increasing the risk of credential-based attacks.
Detects when a new federated identity credential is successfully added to an Azure Active Directory (Entra ID) application. This activity is a common method for attackers to establish persistent access to cloud resources by bypassing password-based authentication.
Detects changes to SharePoint tenant-level or site-level sharing policies that expand external access to 'Anyone' (anonymous links) or 'ExternalUserAndGuestSharing'. Such modifications represent a significant security posture regression that may facilitate unauthorized data access or facilitate exfiltration pathways.
Detects the SharkLoader 'Perfect DLL Hijacking' technique where SystemSettings.exe loads a malicious DLL from user-writable AppData directories and then manipulates LdrpLoaderLock to spawn a malicious thread. This is identified by SystemSettings.exe loading DLLs from specific AppData subfolders (e.g., xwreg, xgdf) and subsequently creating a remote or local thread.
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.
Detects WMI persistence mechanisms by monitoring for suspicious child process spawning from WMI host processes (scrcons.exe, wbemcons.exe), unauthorized loading of MOF files via mofcomp.exe, and execution of common living-off-the-land binaries directly by the WMI provider host (wmiprvse.exe).
Page 66 of 401