Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects token duplication/impersonation targeting winlogon.exe to obtain SYSTEM privileges (SeDebugPrivilege abuse, DuplicateToken, SetTokenInformation to Untrusted integrity)
Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.
Detects the creation of a new AWS S3 bucket followed by a large volume of data uploads (more than 200 objects) within a 2-hour window. The detection focuses on activity attributed to a single identity with limited source IP diversity, which is highly indicative of scripted data staging and potential exfiltration preparation by an unauthorized actor.
Detects the creation of a new AWS S3 bucket followed by a large volume of data uploads (more than 200 objects) within a 2-hour window. The detection focuses on activity attributed to a single identity with limited source IP diversity, which is highly indicative of scripted data staging and potential exfiltration preparation by an unauthorized actor.
This rule detects potential COM hijacking of the CLSID InprocServer32 registry keys or unauthorized loading/creation of the 'EhStoreShell.dll' file. These behaviors are common indicators of persistence mechanisms or DLL side-loading where attackers redirect legitimate system calls to malicious code.
This rule detects potential COM hijacking of the CLSID InprocServer32 registry keys or unauthorized loading/creation of the 'EhStoreShell.dll' file. These behaviors are common indicators of persistence mechanisms or DLL side-loading where attackers redirect legitimate system calls to malicious code.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Identifies service principals or managed identities assigned high-privilege roles or permissions that exhibit anomalous access patterns by interacting with cloud resources not seen in the established historical baseline.
Detects the creation of new AWS access keys or login profiles for a target identity immediately following the deletion or modification of a credential for the same identity, where the actors performing the two actions are different. This pattern indicates an adversary creating persistent access after a security incident responder or automated system has revoked a previously compromised credential.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
Detects potential device-code phishing abuse where a successful device code authentication is followed by scripted API activity using common automation user agents within a short time window (10 minutes). This behavior is indicative of an attacker who has successfully phished a user's device code and is immediately leveraging the stolen token to interact with Microsoft Graph, Azure, or Intune services.
Detects potential device-code phishing abuse where a successful device code authentication is followed by scripted API activity using common automation user agents within a short time window (10 minutes). This behavior is indicative of an attacker who has successfully phished a user's device code and is immediately leveraging the stolen token to interact with Microsoft Graph, Azure, or Intune services.
Detects potential device-code phishing abuse where a successful device code authentication is followed by scripted API activity using common automation user agents within a short time window (10 minutes). This behavior is indicative of an attacker who has successfully phished a user's device code and is immediately leveraging the stolen token to interact with Microsoft Graph, Azure, or Intune services.
This rule detects suspicious command executions (e.g., whoami, downloadstring, iex, registry modifications) initiated by processes associated with the CrowdStrike Falcon agent. It also correlates these executions with the loading of unsigned or unverifiable DLLs by the same Falcon processes within a 5-minute window, which may indicate attempts to tamper with or masquerade as the security agent.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden windows) initiated by mshta.exe, excluding instances where a .ps1 script file is involved. This pattern often indicates attempts to bypass execution policy or run obfuscated payloads in memory, which is a common behavior of malicious HTA files.
Detects a Parallels appliance tar archive containing a directory entry name with an embedded double-quote character followed by the --use-compress-program flag, characteristic of the ParaShells (CVE-2026-90894) tar argument-injection payload
Detects the 'prl_disp_service' process spawning 'tar' with the '--use-compress-program' flag set to an unconventional binary. This behavior is associated with the exploitation of ParaShells (CVE-2026-90894), where an attacker leverages the compression program hook in 'tar' to execute arbitrary commands with root privileges.
Page 157 of 864