Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of a scheduled task via schtasks.exe that involves PowerShell executing commands via IEX and IRM, a technique associated with the DeepLoad malware to maintain persistence.
This rule detects when the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library from a file path outside of the standard, expected directories (such as Windows Defender or System32 folders). This behavior is often indicative of potential DLL side-loading, where an attacker attempts to substitute a legitimate system DLL with a malicious version to execute code in the context of a trusted Microsoft process.
Detects the modification or creation of registry values under the Windows Local Security Authority (LSA) configuration key, specifically targeting the 'Authentication Packages' or 'Security Packages' values. Adversaries often use these registry locations to inject custom DLLs that are loaded by the LSA process (lsass.exe) at system boot for persistence or credential dumping.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
Detects modifications to the Windows Registry keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network. These keys control which services or drivers are permitted to load during Safe Mode with Networking. Unauthorized changes to these keys can be used to ensure malicious drivers or services load during Safe Mode, providing a persistence mechanism that bypasses many security controls.
Detects the modification or creation of registry values under the Windows Local Security Authority (LSA) configuration key, specifically targeting the 'Authentication Packages' or 'Security Packages' values. Adversaries often use these registry locations to inject custom DLLs that are loaded by the LSA process (lsass.exe) at system boot for persistence or credential dumping.
Detects the creation of a Windows Scheduled Task with command line arguments indicative of the Potemkin Loader, which uses task scheduling to maintain persistence by executing an RMM payload located in the AppData directory upon system startup or user logon.
This rule detects attempts to tamper with Windows Defender services (WinDefend, SecurityHealthService, wscsvc) by stopping or disabling them. It covers actions performed via 'sc.exe' commands, 'Set-Service' PowerShell cmdlets, and direct modification of registry keys related to these services. The rule specifically filters out legitimate system and TrustedInstaller processes when detecting registry modifications to reduce false positives.
Detects svchost.exe (hosting Windows Store Install Service) loading InstallServicePlugin.dll from a UNC path or making outbound SMB connections as NT AUTHORITY\SYSTEM. This indicates successful UNCanny coercion where the SYSTEM-level service performs LoadLibraryW against an attacker-controlled UNC path, enabling NTLM machine account capture or SYSTEM code execution.
Detects the execution of the 'unshare' utility with arguments that create new user, network, and mount namespaces (-U, -n, -r) by a non-root user. This technique is often used to bypass namespace restrictions or perform privilege escalation by gaining elevated capabilities within a new, user-controlled namespace.
This rule detects the creation of shortcut (.lnk) files within the Windows Startup folder initiated by potentially suspicious processes such as WinRAR, unrar, or PowerShell. This behavior is indicative of an attempt to achieve persistence by ensuring the execution of a malicious file upon user login.
Detects when a user or machine account is added to a highly privileged Active Directory group. This event is often a sign of privilege escalation or persistence establishment by an adversary.
This rule detects unauthorized modifications to sensitive Group Policy Object (GPO) attributes, such as file system paths, version numbers, or extension settings. It monitors Security Event 5136 for changes targeting GPO containers by non-standard administrative accounts, flagging potential attempts to persist access or escalate privileges via GPO tampering.
This rule detects the modification of the SID History attribute on Active Directory accounts (Event ID 4765) or failed attempts to do so (Event ID 4766). The SID History attribute can be abused to gain unauthorized access and escalate privileges across domain boundaries by injecting well-known or administrative SIDs, a technique known as SID-History Injection.
Detects when a user or machine account is added to a highly privileged Active Directory group. This event is often a sign of privilege escalation or persistence establishment by an adversary.
This rule detects unauthorized modifications to sensitive Group Policy Object (GPO) attributes, such as file system paths, version numbers, or extension settings. It monitors Security Event 5136 for changes targeting GPO containers by non-standard administrative accounts, flagging potential attempts to persist access or escalate privileges via GPO tampering.
Detects attempts to bypass User Account Control (UAC) by abusing 'eventviewer.exe'. This rule specifically looks for 'eventviewer.exe' being initiated by suspicious processes like 'powershell.exe', 'cmd.exe', 'rundll32.exe', or 'Optimax.dll', while excluding legitimate command-line usage of 'eventvwr.exe'.
Detects the Python Imaging Library (PIL) memory leak used to bypass ASLR prior to the JPEG2000 heap overflow. This KQL query specifically looks for syslog messages containing 'cannot identify image file' and 'BytesIO object at 0x', which are indicators of this specific memory leak vulnerability being triggered.
This rule detects various methods used to extract credentials protected by the Windows Data Protection API (DPAPI). It covers multiple vectors, including Mimikatz DPAPI module usage, unauthorized loading of the dpapi.dll library, suspicious access to browser or WiFi credential stores, and cross-process memory access to the LSASS process to extract DPAPI master keys.
This rule detects when sensitive administrative roles are assigned directly to users in Microsoft Entra ID (formerly Azure AD) without utilizing the Privileged Identity Management (PIM) service. Direct assignment of these roles bypasses the security controls and JIT (Just-In-Time) access workflows enforced by PIM, potentially indicating unauthorized privilege escalation or a misconfiguration.
This rule detects potentially malicious activity within Azure Automation by monitoring for the creation or modification of runbooks and jobs, combined with the presence of suspicious command-line or script patterns in job stream output, such as credential harvesting (e.g., Get-AutomationPSCredential) or execution of web-based payloads (e.g., IEX, Invoke-WebRequest).
Page 95 of 401