Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the creation of Windows services initiated by ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This behavior is indicative of the abuse of the Windows Package Manager (WinGet) DSC configuration engine to install persistent malicious services, potentially leveraging PSDscResources.
Detects unauthorized, unauthenticated API activity targeting the ServiceNow 'related_list_edit' Scripted REST resource. The rule specifically alerts on requests originating from the 'Guest' account or where authentication requirements have been disabled, which are known indicators of exploitation.
Detects network traffic over SMB targeting the SYSVOL or NETLOGON network shares that includes the transfer or reference of common executable file extensions. This behavior is indicative of an adversary attempting to stage malicious payloads for deployment via Group Policy Objects (GPOs), a common method for lateral movement and persistence.
Detects the SPECTRALVIPER actor's malicious activity where IntelAudioService.exe is utilized to sideload the unauthorized 'DtlCrashCatch.dll' library, which then performs reflective code injection into the 'OneDrive.Sync.Services.exe' process for in-memory payload execution.
Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.
This rule detects potential lateral movement and privilege escalation activity associated with the SPECTRALVIPER framework. It identifies suspicious process launch events where method names indicative of token manipulation (e.g., StealToken, MakeToken, Impersonate_ThisThread) are present in the command line, or where the OneDrive Sync Service process is used as an indicator of this specific activity.
Detects instances where the Windows Subsystem for Linux (WSL2) wsl.exe process is used to execute curl or wget from the Windows host. This technique is often used to stage payloads or download tools from the internet, effectively bypassing Windows-based EDR network monitoring as the network connection occurs within the isolated WSL2 environment.
Detects the execution of child processes by wsl.exe. Attackers may use the Windows Subsystem for Linux (WSL2) to execute code, stage payloads, or initiate network connections within the isolated WSL2 VM environment, potentially bypassing Windows-based endpoint monitoring and network security controls.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects file modification or creation events affecting critical authentication components, specifically Pluggable Authentication Modules (pam_unix.so) and OpenSSH binaries (sshd, ssh, scp). Such activity is highly indicative of an attempt to backdoor the authentication process to facilitate unauthorized access or credential theft, as observed in Operation Highland.
Detects the modification or creation of shared object files (.so) within common Linux Pluggable Authentication Modules (PAM) directories. Adversaries often modify these modules to establish persistence, capture credentials, or create backdoors for authentication bypass.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
This rule detects modifications to sensitive Windows Registry keys under HKLM\SOFTWARE\Microsoft\Cryptography, such as Providers, OID, Trust, and Protectedroots. These keys control cryptographic services and trust stores on Windows systems. Modifications by non-system processes or accounts may indicate attempts to subvert trust controls, install rogue root certificates, or tamper with system-level security providers.
Detects instances where the Dllhost.exe (COM Surrogate) process writes executable files, scripts, or library files to common temporary or public directories. This behavior is often associated with COM hijacking, lateral movement, or malicious payload staging by adversaries.
Detects processes that execute and remain dormant for more than 120 seconds before performing a high volume of file operations (greater than 50) or initiating a high volume of network connections (greater than 20). This pattern is consistent with malware or beaconing implants attempting to evade detection during automated sandbox analysis.
This rule detects unauthorized modifications or creations of files within critical Linux Pluggable Authentication Module (PAM) directories (such as /etc/pam.d/ and /lib/security/). Attackers often target these files to implement backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common package management tools to minimize false positives.
Detects suspicious behavior involving the 'uptime' system utility, including execution from non-standard paths, unexpected outbound network connections, spawning child processes, or replacement of the legitimate /usr/bin/uptime binary. These behaviors are indicative of masquerading or binary hijacking.
This rule monitors Linux authentication logs for anomalies related to Pluggable Authentication Modules (PAM). It identifies potential security risks by detecting file operations (read, write, create) within PAM-related processes, references to world-writable or temporary directories that may be used for staging credentials, and unusual authentication event patterns.
Detects the execution of known GSocket/GS-Netcat tools or the usage of the 'uptime' command when accompanied by network activity, which may indicate process masquerading.
This rule detects unauthorized write, modification, or creation events on critical SSH binary files (sshd, ssh, scp) on Linux systems. It excludes legitimate package management tools (e.g., apt, yum, dpkg, rpm) from triggering alerts to reduce noise from system updates.
Page 310 of 864