Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
Detects the creation or modification of Windows Registry Run keys that point to potential Node.js applications or scripts. This is a common persistence technique where attackers configure malicious scripts to execute upon user logon or system startup.
Detects suspicious activities within GitHub repository logs that indicate potential supply chain attacks, including the use of unauthorized workflow names, the creation of orphan snapshot branches, dependabot impersonation attempts, commit messages containing known campaign markers, exposure of internal secrets (HAS_GCR_TOKEN), and the push of suspicious files or configuration modifications.
This rule detects suspicious inter-process communication (IPC) attempts using WM_COPYDATA messaging, where processes (often script interpreters or unsigned binaries) interact with high-value GUI-based applications (like browsers or shell environments). This pattern is a common indicator of process injection techniques, such as hijacking existing Windows callbacks to execute code within the context of a target process.
Detects multiple techniques associated with Linux post-exploitation and persistence, including LD_PRELOAD environment variable hijacking, suspicious cron jobs, profile.d persistence modifications, systemd service masquerading via prctl, and fileless execution via memfd_create.
This rule detects suspicious activity associated with the TinyRCT malware, specifically identifying the loading of 'MyAppDomainManager.dll' in unexpected process paths or in conjunction with 'chrome_setup.exe'. It also monitors for 'PerfWatson2.exe' instances executing outside of the expected local application data directory, which is a known indicator of this campaign's persistence and execution behavior.
Detects potential UAC bypass or privilege escalation attempts involving the 'runas' command. The rule identifies suspicious process patterns such as non-standard parent processes invoking runas, self-relaunching applications with elevated command-line flags, and specific executable naming conventions associated with known threat actor activities.
Detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects User Account Control (UAC) bypass attempts where known auto-elevating Windows binaries like fodhelper.exe, eventvwr.exe, or sdclt.exe are used as proxy processes to launch child processes with high integrity without user prompts.
Detects execution of the tc (traffic control) utility with pedit actions by non-root users. This pattern is indicative of exploitation attempts targeting the Linux kernel act_pedit subsystem (CVE-2026-46331), which can lead to page cache corruption and local privilege escalation.
Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.
Detects persistence mechanisms used by Gamaredon's Ptero-family implants (e.g., PteroSetup, PteroPSDoor) which modify Windows registry run keys to execute malicious scripts or binaries located in suspicious directories like APPDATA or TEMP. The detection specifically looks for the combination of registry run key modifications and the use of obfuscated or stealthy execution arguments associated with PowerShell, VBScript, or MSHTA.
Detects instances where the WinRAR utility process creates, writes, or drops a file into the Windows Startup folder. This behavior is a common technique used by adversaries to achieve persistence, as any executable placed in this folder will automatically run upon user login.
Detects the use of 'unshare' or 'ip' commands by non-root users to manipulate Linux namespaces (e.g., user, network, or xfrm namespaces). These commands can be used to bypass security restrictions, facilitate container escapes, or perform local privilege escalation by exploiting vulnerabilities in the Linux kernel namespace subsystem.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Detects execution artifacts and prerequisite activities associated with the DirtyClone (CVE-2026-43503) local privilege escalation exploit. This includes monitoring for the creation of unprivileged user namespaces, loading specific kernel modules (esp4, esp6, rxrpc) often used in such exploits, compilation of associated exploit source files, and direct interaction with /proc/self/mem to perform memory-based exploitation.
Detects the GIFTEDCROOK malware performing post-execution cleanup using cmd.exe. The malware utilizes a command-line chain consisting of 'timeout' and 'del' to remove staged payloads from C:\ProgramData and persistence shortcuts (.lnk files) from the user's Startup folder after a delay.
Detects the loading of DLLs with suspicious names ('hook.dll', 'inject.dll', 'logger.dll', 'loader.dll') from common user-writable directories such as 'Temp', 'AppData', or 'Downloads'. These patterns are frequently associated with malware loaders, persistence mechanisms, or unauthorized code injection attempts.
Detects the creation or modification of registry values within the AppCertDlls registry key. Adversaries use this technique to achieve persistence by forcing malicious DLLs to be loaded into every process that calls common Windows API functions such as CreateProcess.
Detects the creation or modification of registry values within the AppCertDlls registry key. Adversaries use this technique to achieve persistence by forcing malicious DLLs to be loaded into every process that calls common Windows API functions such as CreateProcess.
Detects instances where the Windows binary fodhelper.exe spawns various shell or utility processes. This behavior is a common indicator of a User Account Control (UAC) bypass attack, where the attacker leverages the auto-elevation property of fodhelper.exe to execute arbitrary commands with higher privileges.
Page 92 of 401