Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of the VNT tunneling tool disguised as a legitimate VMware executable (vmwared.exe) located in C:\ProgramData\VMware\. The rule also identifies the creation of a scheduled task named 'MicrosoftEdgeUpdate' configured to execute the masqueraded binary at user logon with elevated privileges.
Detects potential container breakout attempts on Windows systems by monitoring for the launch of privileged containers with sensitive host paths mounted, the execution of host-level processes directly spawned by container runtime binaries (docker.exe, containerd.exe), and direct access to sensitive host filesystems (e.g., C:\windows, C:\etc, C:\programdata) by container runtimes.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects consecutive successful AWS ConsoleLogin events for the same user originating from distinct IP addresses within a 10-minute window. This behavior is indicative of a session-based attack such as Adversary-in-the-Middle (AiTM) where session cookies are intercepted and replayed, allowing an attacker to bypass traditional authentication or multi-factor authentication controls.
Detects a potential Conditional Access bypass, often associated with Storm-2372, where a device is registered and immediately followed by a PRT or deviceToken-authenticated sign-in to sensitive cloud applications within one hour. This behavior indicates the usage of non-TPM-attested 'phantom' devices to circumvent device-based security requirements.
Detects instances where the DonutLoader utility performs in-memory .NET payload execution. It identifies suspicious behavior by tracking the loading of clr.dll into a process that is not a recognized .NET host, concurrent with evidence of process hollowing techniques such as memory unmapping and process writing (NtUnmapViewOfSection, WriteProcessMemory, ResumeThread).
Detects potential DLL hijacking persistence by identifying modifications to registry values containing executable or library files that point to locations outside standard Windows system directories (System32 or SysWow64), subsequently joined with the execution of legitimate binary proxies known to be abused for side-loading like rundll32.exe or regsvcs.exe.
Detects the use of command-line arguments associated with Windows token impersonation techniques (e.g., 'SeImpersonate', 'ImpersonateLoggedOnUser') initiated by common command-line interpreters (powershell.exe, cmd.exe, wmic.exe). This activity is often indicative of an adversary attempting to elevate privileges by stealing or manipulating access tokens.
Identifies logins from known malicious VPN/Proxy exit nodes geolocated in Canada, specifically attempting to bypass geographic conditional access rules. This rule joins location data with threat intelligence indicators to detect suspicious access patterns.
Detects the threat actor creating inbox rules to delete or archive emails containing keywords like "deposit", "payroll", "HR", "Workday", or "ADP" to hide their tampering, often associated with the Storm-2755 campaign.
Detects potential Remcos RAT loader activity involving process hollowing or injection into browser processes. This rule specifically looks for common browser executables (iexplore.exe, chrome.exe, firefox.exe) where the initiating parent process is 'Optimax.dll' or contains 'SystemOptimizer', which are indicators associated with the Remcos RAT loader.
This rule detects the usage of standard Windows system administration utilities (infinstall.exe, devcon.exe, pnputil.exe, sc.exe) when the command line arguments include keywords commonly associated with driver loading or kernel-level operations, which may indicate the installation of a rootkit or malicious driver.
This rule detects the suspicious loading of 'msimg32.dll' by 'consent.exe' from non-standard directories, specifically targeting temporary folders often used by the Bumblebee malware loader. This behavior is indicative of DLL side-loading to execute malicious code within the context of a legitimate system process.
Detects anomalous activity involving the Windows consent.exe process, which handles User Account Control (UAC) elevation prompts. Specifically, this rule monitors for instances where consent.exe is spawned from the Temp folder, spawned by msiexec.exe from the Temp folder, or loads a suspicious version of msimg32.dll from a non-System32 directory. These behaviors are often indicative of UAC bypass attempts or DLL hijacking related to privilege escalation.
This rule detects suspicious activities involving the Microsoft Edge browser (msedge.exe). It monitors for the spawning of known command-line utilities (e.g., cmd.exe, powershell.exe) by the browser process and the loading of DLLs that do not originate from expected Windows or Microsoft Edge installation directories. Additionally, it correlates these events with recent Microsoft Edge application crashes on the same host, which may indicate exploitation attempts.
This rule detects sensitive modifications to payroll-related information in Workday, such as bank account details, direct deposit settings, or payment method changes. It flags instances where such modifications occur from multiple IP addresses for the same user account, which may indicate account compromise and unauthorized attempts to divert funds.
This rule detects suspicious activity involving Docker containers, specifically focusing on path traversal attempts via the 'docker cp' command, execution of potential proof-of-concept scripts, or the creation of specific marker files indicating attempts to interact with or escape from the containerized environment to the underlying host.
Detects the creation of persistence mechanisms, specifically cron jobs or LaunchAgent plist files, initiated by the OpenClaw agent process tree (openclaw, openclaw-runtime, openclaw-agent). This behavior is associated with ClawHub skills attempting to maintain C2 access after the skill itself has been removed.
Detects unauthorized modifications to SSH authorized_keys files and changes to SSH configuration (specifically PermitRootLogin) on Cisco SD-WAN controllers, which may indicate persistence or unauthorized remote access attempts.
Detects indicators of exploitation attempts for the libssh2 pre-auth heap RCE vulnerability (CVE-2026-55200). The rule monitors for the execution of known harness binaries, abnormal child processes spawned by sshd, unauthorized file creation in sensitive temporary directories, and the loading of libssh2 libraries from non-standard, writable locations.
Page 89 of 401