Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects the execution of mavinject.exe with the /INJECTRUNNING command-line argument. This utility is a signed Microsoft binary that can be abused by adversaries to inject arbitrary DLLs into the address space of running processes, a technique often used to evade detection or achieve code execution.
Detects the creation or modification of Windows Registry Run or RunOnce keys, which are commonly used for persistence to execute malicious code automatically upon user logon. The rule excludes common, legitimate software installers and trusted publishers located in Program Files to minimize false positives.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Detects the use of the sc.exe utility to create a new service on a remote system by specifying a path using a UNC share. This behavior is indicative of lateral movement, where an attacker attempts to execute code on a remote host by installing a service via SMB/Admin Shares.
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine, which enumerates local accounts via NetUserEnum and cycles passwords via LogonUserA (advapi32). A high volume of type-2 interactive logon failures against multiple local accounts in a short window is the key behavioral signal.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects potential persistence attempts via WMI event subscriptions. The rule monitors for the creation of WMI event consumers using 'wmic.exe' with suspicious command line arguments, or the use of 'mofcomp.exe' to compile MOF files by non-standard, non-Microsoft signed processes.
Detects the creation of named pipes with names frequently associated with common post-exploitation tools, such as Cobalt Strike. The rule filters out common browser processes and critical Windows system processes to reduce noise.
This rule detects successful user sign-ins from anomalous IP addresses, indicative of an Adversary-in-the-Middle (AiTM) reverse proxy attack. It correlates successful logins with the receipt of a phishing email containing specific subject keywords ('Code of Conduct') within a two-hour window, suggesting that the login was a direct result of the phishing lure.
Detects the creation or modification of Windows Registry Run keys that point to common LOLBins (Living Off the Land Binaries) like PowerShell, WScript, or MSHTA. This activity is often used for persistence, and the rule specifically excludes Microsoft-signed binaries to reduce false positives.
Detects the creation of WMI Event Subscriptions using wmic.exe or scrcons.exe. Adversaries can use WMI event subscriptions to achieve persistence by executing malicious code when a specific event occurs, such as system boot or user logon.
Detects a compromised account revoking refresh tokens, signing out other sessions, or replacing authentication state to retain exclusive access. This behavior is indicative of an attacker attempting to maintain exclusive control over a compromised account by invalidating other legitimate sessions or tokens.
Detects cross-process activity where an unsigned executable residing in common user-writable directories (AppData, Temp, ProgramData) attempts to interact with or inject into sensitive system processes (explorer.exe, svchost.exe, notepad.exe). This behavior is characteristic of malicious process injection attempts.
This rule detects potential credential dumping attempts against the Local Security Authority Subsystem Service (LSASS). It monitors two distinct suspicious behaviors: 1) The enablement of 'SeDebugPrivilege' by non-system processes via Windows security event 4703, and 2) Suspicious OpenProcess calls targeting sensitive Windows processes (lsass.exe, csrss.exe, winlogon.exe, services.exe, smss.exe) initiated by non-system accounts with high-level access rights.
This rule detects potential credential dumping attempts against the Local Security Authority Subsystem Service (LSASS). It monitors two distinct suspicious behaviors: 1) The enablement of 'SeDebugPrivilege' by non-system processes via Windows security event 4703, and 2) Suspicious OpenProcess calls targeting sensitive Windows processes (lsass.exe, csrss.exe, winlogon.exe, services.exe, smss.exe) initiated by non-system accounts with high-level access rights.
This rule monitors for unauthorized deletion or modification of Microsoft Sentinel alert rules and automation rules. Such actions are indicative of an attacker attempting to impair security monitoring, silence alerts, or disable automated responses to maintain persistence and evade detection.
Detects the creation of named pipes with names commonly utilized by offensive C2 frameworks such as Cobalt Strike, Metasploit, and Covenant. By monitoring for specific pipe naming patterns created by non-system processes, this rule aims to identify potential post-exploitation activity, C2 beacons, or lateral movement tools.
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
Detects the creation or modification of Windows scheduled tasks using Security Event IDs 4698 and 4702. This rule parses the event data to extract key task information such as task name, command, arguments, and the author of the task.
Page 94 of 401