Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
This rule detects potentially unauthorized root account activity by monitoring for 'root' logon events and privileged process execution (such as 'su' or 'sudo'). It flags sessions or commands that occur outside of defined business hours, originate from unapproved IP addresses, use unapproved accounts, or are executed via suspicious parent processes, providing a high-confidence indicator of anomalous administrative behavior.
Detects execution and file activity associated with the XRed backdoor, which masquerades as 'Synaptics.exe' by running from the non-standard 'C:\ProgramData\Synaptics\' directory instead of authorized system paths.
Detects anomalous certificate-based authentication attempts to Jasmine network services characterized by rapid, impossible-travel scenarios or geo-inconsistent session patterns. This behavior is indicative of a stolen certificate being reused from a different geographic location or network, bypassing standard authentication patterns.
Detects anomalous certificate-based authentication attempts to Jasmine network services characterized by rapid, impossible-travel scenarios or geo-inconsistent session patterns. This behavior is indicative of a stolen certificate being reused from a different geographic location or network, bypassing standard authentication patterns.
Detects anomalous certificate-based authentication attempts to Jasmine network services characterized by rapid, impossible-travel scenarios or geo-inconsistent session patterns. This behavior is indicative of a stolen certificate being reused from a different geographic location or network, bypassing standard authentication patterns.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects network-based exploitation attempts against Dahua Easy4IP P2P relay infrastructure, including reconnaissance probes, unauthorized relay usage, and credential theft attempts via WSSE authentication.
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects the creation of a new AWS S3 bucket followed by a large volume of data uploads (more than 200 objects) within a 2-hour window. The detection focuses on activity attributed to a single identity with limited source IP diversity, which is highly indicative of scripted data staging and potential exfiltration preparation by an unauthorized actor.
Detects suspicious DLL loads or file drops performed by security product processes (avp.exe, MsMpEng.exe) from directories outside of standard, trusted vendor paths. It specifically flags unsigned or invalidly signed DLLs, which is indicative of DLL sideloading techniques used to abuse security software workflows for potential privilege escalation.
This rule detects instances where a process named 'wsc_updata.exe' executing from a Temp directory loads a library named 'wsc.dll'. This behavior is characteristic of DLL side-loading or DLL hijacking, where a malicious or potentially unwanted executable attempts to load a library from a user-writable directory to execute arbitrary code.
This rule detects potentially malicious activity where a critical system library like 'kernelbase.dll' is loaded into a Chrome process, followed by events indicative of reflective DLL injection or memory-based code loading. Such behavior is often associated with browser-based exploitation, where an attacker attempts to inject malicious code into the legitimate Chrome process space to maintain persistence or conduct further malicious activities.
Detects suspicious process injection attempts originating from or targeting the Google Chrome browser (chrome.exe). The rule identifies cross-process activities such as remote thread creation or opening processes with high-privilege access masks (0x1FFFFF), which are common techniques used by malware to execute code within the memory space of a legitimate web browser.
This rule detects a correlation between the creation of a specific suspicious file named 'A08744D2.tmp' and the subsequent activity of the Windows Media Player Network Sharing Service ('wmpnetwk.exe') within a short time window. This pattern often indicates potentially malicious activity where a temporary file may be used to stage or interact with the service process.
Detects the legitimate wmpnetwk.exe process, commonly used as a target for ShadowPad process injection, initiating outbound network connections while simultaneously accessing Firefox browser profile data. This behavior is indicative of credential theft and command-and-control communication typical of post-compromise activity.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Page 163 of 864