Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects attempts to disable or tamper with security software, including Windows Defender, Windows Firewall, and various third-party antivirus agents, via PowerShell commands, service management utilities, or registry modifications.
Detects attempts to modify or delete Microsoft Graph API conditional access policies. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
Detects PowerShell-based malware stagers used by ErrTraffic ClickFix campaigns that download and execute second-stage payloads using encoded commands and common download cradles. It also detects certutil.exe used for decoding.
Detects the loading of DLL files from user-writable or non-standard directories (e.g., AppData, Temp, ProgramData) that are often used in DLL sideloading attacks to hijack application search order. This rule identifies patterns associated with TRUSTRAP-style activity where a malicious DLL is placed in an adversary-controlled directory to be loaded by a legitimate application.
Detects the abuse of the Windows built-in Certutil.exe utility for deobfuscating files or downloading remote content. This rule identifies common patterns associated with malicious activity, including the decoding of encoded files and the use of the urlcache flag to download remote files, which are techniques often used to bypass security controls and retrieve second-stage payloads.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
This rule detects attempts to inject code into or patch the Anti-Malware Scan Interface (AMSI) DLL (amsi.dll). It monitors for Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) initiated by suspicious processes like PowerShell or scripting hosts where the target is amsi.dll or where amsi.dll is being accessed in a way consistent with memory patching or hooking, aiming to bypass endpoint security scanning capabilities.
Detects the spawning of root shells from suid binaries (su) in conjunction with user namespace creation or suspicious parent process execution, potentially indicating exploitation of local privilege escalation vulnerabilities like the pedit COW page cache poisoning (CVE-2026-46331). The detection correlates non-root process activity in suspicious locations with subsequent elevated shell creation.
This rule detects suspicious activity patterns on Linux systems that may indicate privilege escalation or container escape attempts. It monitors three main behaviors: the execution of network configuration tools (tc, insmod, modprobe) for kernel-level manipulations (pedit/actions), the use of 'unshare' to create isolated namespaces, and typical privilege escalation commands (su, id, whoami, bash) executed by non-root users. The rule correlates these events and alerts based on the combination and intensity of these behaviors, flagging high-severity activity when kernel-level tools are combined with namespace manipulation or privilege elevation.
Detects evidence of the MYRA Linux RAT, which uses LD_PRELOAD hijacking via a malicious library located at /usr/local/lib/.libcache.so for persistence or execution flow hijacking. The rule also identifies the malware's practice of masquerading as the 'systemd-userdbd' service, often launched from a Node.js-based environment.
Detects the use of common scripting engines (PowerShell, WScript, CScript, MSHTA) to perform system fingerprinting, sandbox detection, or execution timing delays. This activity is often indicative of early-stage malware or reconnaissance tools attempting to identify if they are running in a virtual or analysis environment before proceeding with malicious activity.
Detects execution patterns associated with the DirtyClone (CVE-2026-43503) exploit, which involves an unprivileged process utilizing user and network namespaces to configure IPsec XFRM Security Associations (SAs) to corrupt the kernel page cache of sensitive binaries such as /usr/bin/su.
Detects a suspicious execution chain where 'node-gyp' is observed spawning 'node' to execute 'index.js', characteristic of a 'Phantom Gyp' malicious pattern, followed immediately by the execution of a temporary JavaScript payload via the 'bun' runtime. This pattern is indicative of a multi-stage loader often used in supply chain attacks involving obfuscated payloads.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Detects execution of system discovery and evasion commands commonly used by the Gamaredon group's Ptero-family tooling. The rule monitors for mshta.exe, wscript.exe, or cscript.exe spawning wmic, powershell, or cmd to execute queries related to virtualization artifacts (e.g., VirtualBox, VMware) or time-based evasion (e.g., Start-Sleep).
This rule detects post-execution activity associated with the lambsys/isp.sh cryptominer campaign. It triggers when a known miner binary (lambsys, procq, or isp.sh) is executed, followed within 3 minutes by suspicious cleanup operations including the deletion of log files (wtmp, btmp, system logs), staging directories, or tampering with command history files and shell environment variables.
Detects web traffic containing specific randomized CSS filter properties on top-level elements, frequently seen in Bluekit PhaaS toolkits. These properties are used to alter the visual hash of the rendered page, complicating automated screenshot or pixel-based analysis by security vendors. This technique is often combined with suspicious URL patterns indicative of credential harvesting sites.
Detects execution of sensitive administrative binaries (rm, chmod, chown) targeting critical system files or directories, or direct interaction with sensitive system files and configuration logs which may indicate unauthorized data access or evidence tampering.
This rule detects successful SSH login events utilizing public key authentication for the 'vmanage-admin' user. It aggregates login events by source IP, username, and host to identify patterns of access for this specific administrative account.
Detects unauthorized attempts to extract the Active Directory database (NTDS.dit) for credential harvesting. The rule monitors for common administrative tools like ntdsutil.exe and vssadmin.exe being used to create shadow copies or extract the NTDS database, as well as direct file manipulation of ntds.dit. This activity is often associated with post-exploitation credential dumping techniques.
Page 324 of 864