Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,408 detections
Filters
Last updated
All Time
Detection languages
3,122
2,730
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,696
1,319
905
813
750
Platforms
5,933
913
886
299
280
Products / Services
1,617
1,401
1,091
454
419
MITRE Techniques
18,128
15,650
12,597
8,408
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects instances where a process attempts to open a handle to itself with high-privilege access rights (e.g., PROCESS_ALL_ACCESS, PROCESS_VM_WRITE, PROCESS_VM_OPERATION). This behavior is often indicative of self-injection, a technique used by malicious code to modify its own memory space or inject shellcode, evading detection and bypassing certain security controls.
Detects a sequence of events within a 30-minute window for a single user, specifically capturing MFA configuration changes (reset/enrollment), authentication, and device registration, occurring outside of typical business hours (20:00 - 06:00). This behavioral pattern is often indicative of an adversary establishing persistence or account takeover after gaining access to a valid account.
This rule detects authentication events for service accounts (matching patterns like 'svc', 'sa', 'service') originating from at least two different countries within a short time window (30 minutes or less), indicating potential credential compromise and anomalous geographic movement.
Detects the creation of a scheduled task masquerading as a legitimate Mozilla maintenance task (UpdateTask or ElevateTask). The rule specifically flags when such tasks are configured to run as SYSTEM, triggered on system start, and are created via a command line executed by a parent process of cmd.exe, which is indicative of Payouts King ransomware persistence activity.
Detects evidence of process hollowing and injection techniques associated with the TA4922 (Silver Fox) threat actor. The rule monitors for three primary indicators: remote thread creation into common target processes (svchost, explorer, etc.) by non-system images, process access with high privilege handles (0x1fffff/0x1f3fff) targeting those same processes, and the execution of system binaries from non-standard filesystem locations.
Detects BQTLock ransomware (BaqiyatLock) establishing persistence by creating scheduled tasks via schtasks.exe. The detection monitors for scheduled task creation commands initiated by the ransomware payload (BQT.exe) or its loader (start.exe), specifically targeting tasks that execute files from high-risk paths like AppData or Temp, or directly reference BQT.exe.
Detects the installation of a new Windows service where the ImagePath contains strings commonly associated with remote access or remote control software, such as 'remotepc' or 'rpclient'. This may indicate the unauthorized deployment of remote administration tools.
This rule detects DLL loading events where specific legitimate applications (Adobe Creative Cloud, Microsoft Edge, or Opera GX) load a DLL from their own directory where the DLL file is unsigned or has an invalid digital signature. This pattern is often indicative of DLL sideloading, where an attacker places a malicious DLL in the application's folder to be loaded by the legitimate process.
This rule monitors for two distinct behaviors: direct modification of Group Policy Object (GPO) containers within Active Directory and suspicious execution of GPO management tools (gpupdate.exe or gpedit.msc) across multiple hosts in a short timeframe. AD modification events are flagged as critical, while elevated tool execution patterns are flagged as high or medium risk based on host prevalence.
This rule detects the creation of scheduled tasks that are configured with high-privilege execution levels (SYSTEM or highest) or that reference suspicious file paths and filenames commonly associated with persistence mechanisms or VM image masquerading (e.g., QEMU files, .qcow2, vault.db). It monitors both command-line execution of schtasks.exe (Sysmon Event ID 1) and Task Scheduler configuration events (Windows Event ID 4698).
Detects the creation of scheduled tasks using schtasks.exe that reference specific QEMU binaries, the 'TPMProfiler' task name, or suspicious disk image file extensions (vault.db, bisrv.dll, custom.qcow2). This activity is associated with GOLD ENCOUNTER, STAC4713, and STAC3725, who use QEMU-based virtual environments for defense evasion and persistence.
Detects instances where wscript.exe spawns a child process of itself with the /elevated command-line flag, a behavior often indicative of attempts to bypass User Account Control (UAC) or gain elevated script execution privileges.
Detects execution of tools and scripts known for exploiting the Zerologon (CVE-2020-1472) vulnerability, including zerologon_tester.py, zerologon.py, and Impacket-based Netlogon authentication abuse. The rule monitors command-line activity for these indicators, excluding processes signed by Microsoft.
Detects the creation or modification of specific malicious macOS LaunchAgent plist files (com.nvm.protocal.plist) or payload files (protocal.cjs) within the NodePackages directory, indicative of the easy-day-js backdoor establishing persistence.
Detects the execution of wscript.exe or cscript.exe with the /elevated command-line argument, which is a known technique for bypassing User Account Control (UAC) or invoking administrative tasks via COM object elevation.
Detects instances where a Node.js process spawns the 'crontab' utility, likely to modify user cron jobs. This is a common technique used by attackers to achieve persistence by scheduling periodic execution of malicious scripts or reverse shells.
Detects evidence of the MYRA RAT attempting to establish persistence via the LD_PRELOAD environment variable. This is achieved by creating or modifying malicious shared libraries (e.g., .libcache.so) and configuring system startup files (e.g., /etc/profile.d/.sh.local) to ensure the library is loaded by the dynamic linker on startup.
Detects the creation of scheduled tasks designed for persistence, typically used by Operation Poisson (e.g., Demon agent, Python keyloggers). The rule identifies tasks that execute script interpreters (powershell.exe, cmd.exe, wscript.exe, cscript.exe, python.exe, pythonw.exe) with indicators of suspicious intent, such as hidden windows (/WindowStyle Hidden, /c) or elevated privileges (HighestAvailable, HighestPrivilege, AtLogon).
Detects the installation, service creation, registry modification, and network activity associated with the Tailscale VPN tool. This rule monitors for persistent use of Tailscale, which can be utilized by threat actors to establish encrypted mesh access to internal environments.
Detects the creation of a Windows scheduled task using 'schtasks.exe' with the 'Highest' run level, configured to execute either 'powershell.exe' or 'wscript.exe'. This pattern is consistent with persistence mechanisms observed in Operation Poisson, where attackers establish elevated, automated execution of scripts.
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
Page 77 of 401