Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
Detects instances where a non-SYSTEM parent process spawns a child process running as SYSTEM, characteristic of 'Potato' family exploits (e.g., JuicyPotato, PrintSpoofer) leveraging SeImpersonatePrivilege to elevate privileges. The rule specifically filters for known legitimate SYSTEM process spawners while highlighting suspicious parent-child process relationships.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Detects the creation of scheduled tasks using schtasks.exe where the task action executes a scripting engine or living-off-the-land binary (LOLBin). This behavior is often indicative of adversaries attempting to establish persistence or execute code using native system tools to evade detection.
Detects the LokiBot malware spawning aspnet_compiler.exe to perform process hollowing. The rule identifies this activity by monitoring process creation events and filtering out legitimate .NET build processes, targeting the specific behavior of using aspnet_compiler.exe as a host for reflective code injection.
Detects successful authentication to Atlassian Jira from an anomalous network source (e.g., proxied or unusual geolocation/ASN) following a period of credential inactivity. This activity is consistent with tactics used by the HellCat ransomware group, who leverage credentials harvested by infostealers (such as Raccoon, Redline, StealC, or Lumma) to gain initial unauthorized access to corporate Jira environments.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Detects the modification or creation of registry keys related to COM InprocServer32 within the HKEY_CURRENT_USER hive, specifically pointing to executable or library files residing within the user's AppData/Local directory. This technique is commonly used by adversaries for persistence by hijacking COM objects to execute malicious code when legitimate software invokes the hijacked component.
Detects the creation of a hidden shell script file at '/etc/profile.d/.sh.local', a common persistence mechanism used by the MYRA RAT. This file is automatically executed by POSIX-compliant shells during the login process to maintain persistence on Linux systems.
Detects the creation of a LaunchAgent property list (.plist) file on macOS that uses a spoofed Apple namespace label (com.apple.system.services.activity). This behavior is characteristic of the Gaslight malware family attempting to establish persistence.
Detects automated lateral movement attempts using sshpass to perform password spraying or authentication against PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule specifically flags the use of sshpass with lax security settings (StrictHostKeyChecking=no), identifying a pattern associated with the uon_fanout.sh post-exploitation script.
Detects instances where a non-browser, non-updater process attempts to perform process injection into common browser executables (Chrome, Edge, Firefox, IE). This behavior is consistent with process hollowing techniques used by Remcos RAT, particularly observed in campaigns such as FortiBleed, to masquerade malicious activity under legitimate browser processes.
Detects anomalous AWS API activity following a console login where the API calls originate from a different IP address within 10 minutes, potentially indicating the replay of stolen session tokens captured via Adversary-in-the-Middle (AiTM) techniques.
Detects anomalous device registration in Azure AD where a device code flow is used to authenticate to the Device Registration Service (DRS) and the resulting device is registered with an 'Unknown' or 'Linux' operating system. This behavior is indicative of an adversary, such as Storm-2372, using tools like AADInternals to perform phantom device registration to bypass conditional access policies by simulating a device without TPM attestation.
This rule detects suspicious command-line activity indicative of a Remcos RAT loader attempting to establish persistence by copying or moving an executable (.exe) file into the AppData\Roaming directory. It specifically looks for 'cmd.exe' or 'powershell.exe' executing commands that contain both 'AppData\Roaming' or '%APPDATA%' and file manipulation commands ('copy', 'move', 'xcopy', 'REM') along with an '.exe' file extension.
Detects Event 5136 where msDS-KeyCredentialLink is added to an AD object, indicative of Shadow Credentials abuse via Whisker/DSInternals. The rule filters out MSOL_ sync accounts and computer-to-computer self-writes to reduce false positives.
Page 84 of 401