Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects a potential privilege escalation attempt in MyBB where a user with limited Administrator Control Panel (ACP) permissions modifies a user account to join the 'Administrator' group (ID 4) by POSTing to the 'user-users' module.
Detects unauthorized changes to the admin or vmanage-admin user credentials on Cisco SD-WAN Manager. The rule monitors for 'usermod', 'passwd', or AAA password commit commands within the 'vmanage-admin' user context. It specifically identifies a 'change-and-revert' pattern, where the attacker changes a password to gain access and immediately reverts it to evade detection, elevating the risk to critical.
Detects the creation or modification of a Registry Run key value named 'csshost'. This technique is commonly used by malware or persistent threats to achieve automatic execution upon system logon or boot by masquerading as or hijacking a host-related entry.
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
Detects the creation or modification of a Registry Run key value named 'csshost'. This technique is commonly used by malware or persistent threats to achieve automatic execution upon system logon or boot by masquerading as or hijacking a host-related entry.
Detects unauthorized modifications to the vmanage-admin password on Cisco SD-WAN Manager. This rule is designed to identify suspicious credential changes that deviate from standard administrative practices, potentially indicating an actor modifying the default admin credentials for persistence or unauthorized access before attempting to revert the changes to evade detection.
Detects unauthorized changes to sensitive payroll information (such as bank accounts or direct deposit details) or suspicious inbox rule creations within Microsoft 365 or HR SaaS environments that occur immediately following anomalous authentication activity. The rule targets indicators of AiTM (Adversary-in-the-Middle) session hijacking, such as unusual user agents, unmanaged device usage, or potential token reuse.
Detects .NET AppDomainManager injection, a technique used by the Turla threat group (specifically STOCKSTAY.MARKETMAKER), by monitoring registry modifications to the .NETFramework key. An attacker can set AppDomainManagerAssembly and AppDomainManagerType to force the Common Language Runtime (CLR) to load a malicious DLL whenever a .NET process starts, facilitating persistent code execution.
Detects the installation of RustDesk as a Windows service, identified via System event log ID 7045. Adversaries may abuse this remote access tool to maintain persistent, unauthorized remote access to compromised systems, as observed in ransomware intrusions.
Detects Vidar Stealer cloning a browser process (Chrome/Edge/Brave) using NtCreateProcessEx with a NULL SectionHandle to snapshot the browser address space for v20_master_key scanning as part of its Chrome Application-Bound Encryption (ABE) bypass chain.
This rule detects attempts to bypass User Account Control (UAC) using specific Windows executables (eventviewer.exe, fodhelper.exe, computerdefaults.exe, slui.exe) initiated by cmd.exe or powershell.exe. The rule specifically looks for these executables being run from non-standard system directories, indicating a potential UAC bypass technique often observed after an initial compromise, such as via RDP.
Detects the creation, execution, or deletion of Windows scheduled tasks using 'Mozilla' task names (specifically '\Mozilla\UpdateTask' or '\Mozilla\ElevateTask'). The rule identifies tasks created with SYSTEM privileges and 'ONSTART' triggers via schtasks.exe, as well as associated administrative commands to run or delete these tasks, and correlates these with Security Event ID 4698.
Detects privilege escalation events (assigning special privileges or executing privileged operations) occurring on a host shortly after the execution of legitimate remote support tools such as Quick Assist or msra.exe. This pattern is consistent with social engineering campaigns where attackers gain remote access via support tools and then perform local privilege escalation.
Detects creation and deletion of an Azure SQL firewall rule by the same caller within a short window, which can provide temporary database access while reducing later evidence. This behavior is often indicative of an adversary attempting to gain temporary access to a database, perform actions, and then remove their tracks by deleting the firewall rule.
Detects Reynolds ransomware's technique of ntdll loader hijacking for process injection, bypassing userland API hooks. This rule identifies suspicious activity by looking for the loading of GDI32.dll alongside ntdll internal loader routines, combined with API calls such as WriteProcessMemory, NtCreateSection, NtMapViewOfSection, and RtlEncodeRemotePointer, which are consistent with loader-level injection techniques. It also filters out common legitimate processes to reduce false positives.
This rule detects the OXLOADER malware's technique of hijacking the CRT initializer table. It identifies an unsigned process loading a randomly named .ocx file (a copy of dui70.dll with an injected .xtext section) from a temporary or download path. The detection is further refined by correlating this with multiple VirtualAlloc calls, consistent with the malware's three rolling-XOR decryption stubs activated via the RegisterClipboardFormatW CRT initializer hook.
Detects suspicious API calls related to remote thread creation, memory allocation, and screen capturing, along with image loads of GDI32.dll from unusual paths and specific file activity. This rule also identifies processes associated with known malicious software product names.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This technique is used by the CrashFix variant to establish persistence for its Python-based RAT, mimicking a legitimate Windows service to blend in. The detection specifically looks for the task name 'SoftwareProtection', a command line containing 'python.exe', 'pythonw.exe', or 'run.exe' along with 'udp.pyw', and the path '\windows\SoftwareProtectionPlatform\', indicating the malware's attempt to masquerade as a legitimate system component.
Detects enumeration or modification of the AppModelUnlock registry key, specifically 'AllowDevelopmentWithoutDevLicense' or 'IsDeveloperModeEnabled', which are prerequisites for enabling Developer Mode. This activity is relevant to the UNCanny coercion primitive, which leverages loose-file UNC AppX package registration.
Detects sign-ins by Global Administrators using a Temporary Access Pass (TAP) to the Azure Portal. This activity is indicative of potential credential abuse, especially in cross-tenant scenarios, as TAP can bypass MFA. The rule identifies instances where a Global Administrator role is assigned or where a user with 'globaladmin' in their UPN signs in with a TAP.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Page 90 of 401