Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation or starting of a Windows service on a remote host using the Service Control Manager (sc.exe) utility. This is a common method for lateral movement and remote execution of malicious payloads.
Detects the steganographic loader campaign setting HKCU Run key persistence using powershell.exe with -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File pointing to an obfuscated .ps1 script in AppData\Local\Temp, as observed in the FortiBleed/TuglaInsaatci campaign delivering Remcos RAT.
Detects the creation of files within the Windows Startup directory. Adversaries use this folder to achieve persistence by ensuring that malicious files or shortcuts are executed automatically when a user logs in.
Detects the creation of a scheduled task using the schtasks.exe utility with persistence-related triggers such as system startup or user logon. The rule excludes common trusted processes that frequently interact with the Task Scheduler to minimize false positives.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
Detects modifications to the 'Authentication Packages' registry key that include a '.dll' file. Adversaries may abuse authentication packages to execute DLLs when the system boots, establishing persistence and potentially escalating privileges.
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects the W2 Malvertising loader waiting for the EDR to be killed before performing cross-process injection (Process Hollowing) into a new legitimate binary. This rule correlates the loading of a new, non-Windows driver with subsequent process memory injection within a 5-minute window, indicating potential BYOVD (Bring Your Own Vulnerable Driver) attacks followed by in-memory malware execution.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Detects modifications to Registry Run or RunOnce keys that include references to 'ManageEngine' or 'SystemOptimizer' and attempt to execute scripting hosts like wscript, cscript, powershell, or cmd. This behavior is indicative of persistence mechanisms often used by adversaries.
This rule monitors for processes named 'setup.exe' executing from user-writable directories (e.g., AppData, Downloads, Temp) that load unsigned or non-Microsoft DLLs from the same suspicious directories. This pattern is commonly associated with DLL side-loading or malicious installation attempts where a process attempts to load illegitimate code from local user space.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects a suspicious execution chain potentially associated with Deed RAT (used by Mustang Panda/Twill Typhoon), consisting of DLL sideloading by a legitimate signed executable followed by persistence mechanism creation (Registry Run keys or Scheduled Tasks) on the same host. Additionally, it identifies devices exhibiting repeated outbound connections to the same remote public IP over multiple days, serving as an indicator of potential re-compromise or persistent C2.
Detects SystemSettings.exe running from user-writable AppData or ProgramData directories, or SystemSettings.dll being loaded by SystemSettings.exe from these locations. This behavior is indicative of SharkLoader DLL sideloading, often used as a first stage in attacks.
Detects the creation or modification of Windows services using sc.exe where the binary path (binpath) points to suspicious or user-writable directories such as User profiles, AppData, Temp, or Public folders, which are often used by adversaries for persistence or privilege escalation.
Detects the creation or modification of Windows Registry Run keys by processes that are not part of the standard Microsoft Windows installation, suggesting potential unauthorized persistence mechanisms.
This rule detects cross-process operations (such as memory access or thread injection) initiated by processes that are not signed by known, trusted vendors, or that do not reside in protected system directories. This behavior is a common indicator of process injection techniques used to evade security controls.
Detects potentially malicious process execution behaviors, including the use of 'runas.exe' with saved credentials, the execution of 'runas.exe' by unauthorized users, and unauthorized cross-process access to sensitive Windows system processes such as lsass.exe, winlogon.exe, or services.exe, which are common indicators of credential access or privilege escalation attempts.
Detects when a signed process loads a DLL from a non-standard, user-writable directory (e.g., Temp, Downloads, Public folders). This is a common indicator of DLL hijacking or side-loading, where a legitimate signed application is leveraged to load a malicious library from a compromised location.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Page 93 of 401