Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the loading of DLL files from user-writable or non-standard directories (e.g., AppData, Temp, ProgramData) that are often used in DLL sideloading attacks to hijack application search order. This rule identifies patterns associated with TRUSTRAP-style activity where a malicious DLL is placed in an adversary-controlled directory to be loaded by a legitimate application.
This rule detects attempts to inject code into or patch the Anti-Malware Scan Interface (AMSI) DLL (amsi.dll). It monitors for Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) initiated by suspicious processes like PowerShell or scripting hosts where the target is amsi.dll or where amsi.dll is being accessed in a way consistent with memory patching or hooking, aiming to bypass endpoint security scanning capabilities.
Detects the spawning of root shells from suid binaries (su) in conjunction with user namespace creation or suspicious parent process execution, potentially indicating exploitation of local privilege escalation vulnerabilities like the pedit COW page cache poisoning (CVE-2026-46331). The detection correlates non-root process activity in suspicious locations with subsequent elevated shell creation.
This rule detects suspicious activity patterns on Linux systems that may indicate privilege escalation or container escape attempts. It monitors three main behaviors: the execution of network configuration tools (tc, insmod, modprobe) for kernel-level manipulations (pedit/actions), the use of 'unshare' to create isolated namespaces, and typical privilege escalation commands (su, id, whoami, bash) executed by non-root users. The rule correlates these events and alerts based on the combination and intensity of these behaviors, flagging high-severity activity when kernel-level tools are combined with namespace manipulation or privilege elevation.
Detects evidence of the MYRA Linux RAT, which uses LD_PRELOAD hijacking via a malicious library located at /usr/local/lib/.libcache.so for persistence or execution flow hijacking. The rule also identifies the malware's practice of masquerading as the 'systemd-userdbd' service, often launched from a Node.js-based environment.
Detects execution patterns associated with the DirtyClone (CVE-2026-43503) exploit, which involves an unprivileged process utilizing user and network namespaces to configure IPsec XFRM Security Associations (SAs) to corrupt the kernel page cache of sensitive binaries such as /usr/bin/su.
Detects a specific execution pattern where node-gyp.exe spawns node.exe to execute an 'index.js' file. This behavior is associated with the 'Miasma' or 'Mini Shai-Hulud' threat campaigns, which utilize malicious 'binding.gyp' files within npm packages to bypass standard lifecycle script (preinstall/postinstall) security scanners.
Detects a sequence of events consistent with the DirtyClone/DirtyFrag kernel exploit: first, identifying precursor activities such as namespace manipulation (unshare), kernel module loading of networking components (esp4/6, rxrpc), or specific exploit binary execution; followed by an anomalous spawn of a root shell from an unprivileged parent process within a short 5-minute window.
Detects persistence mechanisms via Registry Run keys or Startup folder shortcuts created by PowerShell, WScript, or CScript that are associated with the Gamaredon (ACTINIUM) threat group. The rule correlates these persistence events with prior execution of Ptero-family malware or suspicious encoded PowerShell commands on the same endpoint within a one-hour window.
This rule detects the execution of specific shell processes (sh, bash, crontab) where command-line arguments reference suspicious paths commonly associated with persistence mechanisms or malware, such as /var/tmp/ files or crontab spool directories.
Detects the exploit chain for CVE-2026-43503, an unprivileged kernel exploitation vulnerability. The rule identifies the creation of user and network namespaces by non-root users, followed by the manipulation of XFRM states or policies, and the subsequent loading of ESP kernel modules, which together facilitate privilege escalation.
This rule detects suspicious manipulation of Linux namespaces using the 'unshare' utility or manual modification of user ID mapping files ('uid_map', 'gid_map', 'setgroups') in '/proc/self/'. Such activities are characteristic of container escape attempts or privilege escalation, where an attacker seeks to gain root access on the host or map unprivileged users to privileged IDs within a new namespace.
Detects execution of sensitive administrative binaries (rm, chmod, chown) targeting critical system files or directories, or direct interaction with sensitive system files and configuration logs which may indicate unauthorized data access or evidence tampering.
This rule detects successful SSH login events utilizing public key authentication for the 'vmanage-admin' user. It aggregates login events by source IP, username, and host to identify patterns of access for this specific administrative account.
Detects the Turla threat group's STOCKSTAY malware establishing persistence by creating a registry entry in the HKCU Run key. The persistence mechanism points to 'MicrosoftUpdateOneDrive.exe' located in the '%LOCALAPPDATA%\Programs\SMN\' directory.
Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.
Detects the spawning of DllHost.exe (a Windows COM surrogate process) by identified STOCKSTAY malware components or via suspicious msiexec installations targeting STOCKSTAY directories. This behavior is indicative of inter-process communication (IPC) used by Turla's STOCKSTAY malware suite.
Detects modifications to Windows Registry 'Run' or 'RunOnce' keys involving specific values ('MicrosoftUpdate', 'OneDrive') that do not originate from standard Microsoft or OneDrive installation directories. The rule correlates registry changes with process execution events to identify potentially malicious persistence mechanisms.
Detects instances where a single authentication correlation ID is associated with multiple distinct IP addresses within a 10-minute window, followed by high-risk administrative or data-access actions within 30 minutes. This behavior is indicative of session hijacking or post-authentication account compromise, where an adversary uses stolen session tokens to perform unauthorized activities.
Detects instances where msiexec.exe loads a DLL from non-standard system directories (outside of Program Files or Windows folders) with suspicious naming conventions (e.g., containing 'scheduler', 'update', or 'onedrive'), followed by network activity to public IP ranges or registry persistence modifications. This behavior is indicative of potential DLL side-loading or proxy execution by the Windows Installer binary to achieve persistence or command and control.
Detects the creation of scheduled tasks using names associated with Microsoft Edge or Google update processes to achieve persistence. The rule specifically targets the deployment of known payloads like TinyRCT (vmwared.exe) or PerfWatson.exe at logon with highest privileges, masquerading as legitimate update tasks.
Page 88 of 401