Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects indicators of WMI event subscription persistence, including the creation of WMI event filters, consumers, and bindings. It monitors for the use of command-line tools like wmic, powershell, or mofcomp to manipulate WMI objects, and identifies suspicious process activity originating from WMI provider host or consumer processes.
Detects the execution of consent.exe from a temporary directory path, which is often used in UAC bypass attacks to masquerade as the legitimate Windows UAC prompt process.
This rule monitors for suspicious activities related to System Informer (formerly Process Hacker) and its associated service (phsvc.exe). It detects unauthorized or unusual execution patterns, such as unsigned client binaries, shell spawning, or the use of specific proof-of-concept (PoC) command-line arguments that indicate attempts to abuse the service's privileged capabilities for process management or evasion.
Detects the installation of RustDesk as a persistent Windows service. RustDesk is a remote access tool that has been observed in intrusion chains, including those involving Akira ransomware, to provide hands-on-keyboard access to threat actors.
Detects a suspected malicious activity sequence where PowerShell is used to download the cloudflared utility from GitHub, followed by a silent MSI installation of cloudflared. This sequence is indicative of post-exploitation activity often associated with Bumblebee malware leading to the establishment of covert C2 tunneling, frequently observed in Akira ransomware intrusion chains.
Detects the creation of a 'MasterPackager.Updater' scheduled task by a suspicious instance of RegAsm.exe (hollowed process). The task is configured to execute a VBScript located in C:\Users\Public every two minutes, a known tactic associated with AsyncRAT delivery chains.
Detects the execution of Gitea/Act runner or Docker containers with dangerous configurations that allow host-level access, such as privileged mode, host PID/IPC namespaces, or disabled security profiles (AppArmor/Seccomp). These configurations are often used to escape container isolation or execute commands on the underlying host.
Detects the installation of the RustDesk remote access software as a Windows system service. This is identified by monitoring Event ID 7045 (Service Installation) for service names or image paths associated with RustDesk.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
Detects attempts to perform a container escape using path traversal via the 'docker cp' command. This rule monitors for malicious directory traversal sequences, the creation of specific artifacts used in known PoC exploits for container escapes, and the subsequent execution of scripts or shell interpreters by container management processes.
Detects artifacts and behavioral patterns associated with the exploitation of the SystemInformer PhSvc (Process Hacker Service) ALPC channel to escalate privileges. The rule monitors for unauthorized rundll32.exe process activity spawning cmd.exe with specific command line arguments, the creation of PoC-related files, and the loading of unsigned modules into the rundll32.exe process.
Detects cron-based watchdog persistence installed by lambsys.elf as part of the CVE-2026-33017 Langflow cryptominer campaign. The malware writes a per-user crontab via crontab stdin firing every 5 minutes, checking for lambsys via pgrep and re-downloading from C2 if absent, logging to /var/tmp/check_process.log.
This rule detects potential rogue SD-WAN peering attempts by correlating successful SSH public key authentication using 'vmanage-admin' from known malicious IPs with subsequent network activity on SD-WAN control plane ports (e.g., 48373 for OMP, 830 for NETCONF). It also flags logs containing references to an 'evil_tenant.csv' artifact, which is associated with adversary persistence or unauthorized configuration management in SD-WAN environments.
Detects unauthorized persistence mechanisms on Cisco SD-WAN management plane nodes (vManage, vSmart, vBond). The rule monitors for modifications to SSH authorized_keys files, execution of commands like ssh-keygen or user management utilities, and SSH authentication events or configuration changes (e.g., PermitRootLogin) indicative of backdoored access.
This rule detects attempts to manipulate user or service principal names (SPN/UPN) in Active Directory by adding non-ASCII or zero-width characters. Such modifications can be used by adversaries for obfuscation, to bypass detection mechanisms, or to create stealthy persistence. The rule specifically looks for Event IDs 4738 (User Account Changed) and 5136 (Directory Service Object Modified) where the 'servicePrincipalName' or 'userPrincipalName' attributes contain characters outside the standard ASCII range or zero-width characters like U+200B, U+200C, U+200D.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
Detects when fodhelper.exe, a legitimate Windows utility, is used to spawn processes other than cmd.exe or conhost.exe. This behavior is commonly associated with UAC bypass techniques where fodhelper.exe is abused to execute arbitrary commands with elevated privileges without a UAC prompt.
This rule detects when critical Windows services or processes associated with Active Directory (NTDS, Netlogon, LSASS, LDAP) or the Print Spooler (Spooler, spoolsv.exe) crash multiple times (3 or more) on a machine within a 7-day period. This could indicate instability, a denial-of-service attempt, or a system compromise affecting core services.
Detects the addition of users to specific high-value or sensitive groups in Microsoft Entra ID (Azure AD), which could indicate potential unauthorized privilege escalation or persistence attempts by an attacker.
Page 67 of 401