Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects cross-process memory allocation, memory writing, and thread creation activities targeting critical Windows processes like svchost.exe or explorer.exe. Such actions are commonly utilized by attackers for code injection (e.g., Payouts King tradecraft) to execute arbitrary code within the context of trusted processes, enabling evasion or persistence.
This rule monitors for suspicious activity linked to files or processes within the Windows temporary directory. It identifies three distinct malicious patterns: (1) sensitive privilege usage (e.g., SeDebugPrivilege) by processes running from temp; (2) presence of known malicious file names associated with a specific campaign (vile_*.ico, vile_*.lnk, etc.); and (3) PowerShell execution of a specific decryptor shortcut file from the temp directory.
Detects a potential privilege escalation attempt where an unprivileged user executes a SUID-capable binary (su, sudo, passwd), followed immediately by the creation of a root-owned shell process. This pattern is indicative of exploitation of local privilege escalation vulnerabilities, such as page cache poisoning (e.g., CVE-2026-46331).
This rule detects potentially malicious activity involving the 'nvdaHelperRemote.dll' library and suspicious parent-child process relationships. It identifies instances where a process named 'COU_ITR' spawns suspicious children (cmd, powershell, rundll32), or where 'nvdaHelperRemote.dll' is loaded from non-standard or user-writable directories (such as AppData, Temp, Downloads, or Desktop), which is indicative of DLL hijacking or side-loading techniques.
Detects suspicious sequences of AWS CloudTrail API calls originating from non-console or non-service-account sources (CLI, curl, etc.). The rule flags scenarios where reconnaissance via 'GetCallerIdentity' is immediately followed by sensitive IAM modifications (CreateUser, CreateAccessKey) or privilege escalation attempts (AssumeRole), which may indicate the use of exfiltrated credentials.
Detects in-memory privilege escalation patterns associated with the 'DirtyClone' (CVE-2026-43503) vulnerability. The rule monitors for a sequence of events where an unprivileged process utilizes 'unshare' to create user and network namespaces in conjunction with IPsec XFRM tunnel configurations, immediately followed by the execution of 'su' or 'sudo', resulting in unauthorized root access without disk-based modification of binary files.
This rule detects potential sandbox evasion or environment analysis by identifying multiple disparate system checks (hardware, memory, processor, analysis tool, or uptime checks) performed within a short timeframe by common script interpreters like PowerShell or WScript/CScript.
Detects execution chains where Outlook launches a VBScript file that subsequently invokes PowerShell with encoded commands, characteristic of Gamaredon (ACTINIUM) threat activity. Additionally, it identifies the creation of VBScript/VBE files in temporary directories, which is consistent with the deployment of PteroVDoor or PteroPSDoor loaders.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Shutdown Button". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Detects the BQTLock malware's User Account Control (UAC) bypass technique. This technique involves modifying the registry key HKCU\Software\Classes\mscfile\shell\open\command to hijack the EventViewer COM object. Subsequently, eventvwr.exe is launched, which auto-elevates and executes BQT.exe, bypassing UAC.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
Detects the download, staging, and execution of SoftEther VPN components associated with CL-STA-1062. The rule monitors for the creation of specific SoftEther files, network downloads from known actor staging infrastructure, and the execution of SoftEther binaries masquerading as VMware tools (vmtools.exe).
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
This rule detects activities associated with the DirtyClone (CVE-2026-43503) privilege escalation vulnerability on Linux systems. It monitors for the execution of exploit binaries from world-writable directories, the modification of critical process memory mapping files (/proc/self/uid_map, /proc/self/gid_map, /proc/self/setgroups) by non-root users, the use of unshare to create user namespaces as a precondition, and the anomalous spawning of shells by the SUID binary /usr/bin/su.
Detects execution of AWS CLI subcommands used for credential or identity enumeration (e.g., sts get-caller-identity, iam get-user) when spawned from Amazon Q-related or development environment processes (Node.js/VS Code). This behavior is indicative of potential malicious activity involving a compromised MCP server configuration file (CVE-2026-12957).
Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.
Detects execution of specific malware samples identified as DcRAT that perform environment checks, such as timing analysis using GetTickCount64 and Sleep, combined with system configuration lookups to identify sandbox or analysis environments.
Detects adversary activity associated with CL-STA-1062, specifically the use of archive extraction tools to unpack content into hidden or masqueraded ProgramData directories (VMware, Microsoft, Intel). The rule also monitors for process execution and the creation of scheduled tasks that utilize these specific staging paths.
Detects MYRA RAT masquerading as the legitimate 'systemd-userdbd' daemon by identifying processes with that name running outside expected system paths. It also identifies fileless execution patterns where Node.js or npm processes spawn memfd-backed executables, reference deleted files, or initiate processes using the 'systemd-userdbd' name, characteristic of the Miasma campaign.
Page 301 of 864