Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Detects the execution of known Windows 'Living-off-the-Land' binaries (rundll32.exe, regsvr32.exe, mshta.exe) when they originate from web browsers or office productivity applications, or when they are executed with command-line arguments indicative of network resource loading, remote scripting, or code execution bypasses.
Detects the initiation of a new process where the effective user context is SYSTEM, but the originating process was launched by a non-privileged user account. This behavior is indicative of token manipulation techniques such as token impersonation or theft (e.g., via DuplicateTokenEx or ImpersonateLoggedOnUser) to escalate privileges to SYSTEM.
Detects the abuse of built-in Windows binaries 'regsvr32.exe' and 'msbuild.exe' for proxy execution. Specifically, it flags 'regsvr32.exe' loading remote scriptlets via HTTP and 'msbuild.exe' processing project files containing inline tasks, which are common techniques used to execute arbitrary malicious code while bypassing security controls.
Detects suspicious PowerShell process creation patterns often associated with malicious activity. The rule identifies PowerShell execution invoked by common parent processes (like Office applications or scripting engines) or using highly suspicious command-line arguments such as encoded commands, hidden windows, or common download and execution patterns (e.g., IEX, WebClient).
Detects ClickFix-style social engineering attacks where users are tricked into pasting malicious payloads into the Windows Run dialog. The rule monitors for common scripting interpreters (powershell.exe, cmd.exe, mshta.exe, rundll32.exe) spawned by explorer.exe or mstsc.exe with suspicious command-line patterns indicative of payload delivery, such as obfuscated strings, hidden windows, or short-URL downloads.
Detects scripting interpreters (wscript.exe, cscript.exe, powershell.exe, python.exe) that perform an outbound network connection to known public Generative AI API endpoints and subsequently modify their own script file on disk. This behavior is indicative of sophisticated malware attempting to rewrite its own source code at runtime to evade signature-based detection.
Detects a suspicious sequence of browser navigation/redirection events followed shortly by the manual execution of command-line utilities (PowerShell, CMD, or MSHTA) via explorer.exe, characteristic of 'ClickFix' social engineering attacks where users are tricked into copying and executing commands from their clipboard.
This rule detects the suspicious execution of rundll32.exe or regsvr32.exe, which are commonly abused as Living-off-the-Land Binaries (LOLBins). It identifies potential malicious activity by analyzing command-line arguments for patterns like remote URL requests, usage of scrobj.dll, JavaScript protocols, or specific Squiblydoo attack patterns. Additionally, it monitors for these binaries being executed by parents other than explorer.exe, which is indicative of potential process injection or proxy execution.
Detects anomalous sign-in behavior, including impossible travel (geo-velocity) and non-interactive authentication without MFA, specifically targeting patterns indicative of Adversary-in-the-Middle (AiTM) session token theft.
This rule detects potentially malicious inbox rule creation or modification in Office 365 Exchange. It flags rules that contain keywords associated with financial fraud (e.g., invoice, wire, payment) and include actions that hide evidence (e.g., moving messages to junk or deleting them). It further correlates these actions with suspicious user login activity, such as logging in from a new IP address or country within an hour of the rule change, which is a common indicator of a Business Email Compromise (BEC) account takeover.
Detects the use of token manipulation APIs (DuplicateToken, DuplicateTokenEx, ImpersonateLoggedOnUser), the 'runas' command for credential switching, or the execution of known security token manipulation tools (e.g., incognito, Tokenvator, Invoke-TokenManipulation). This activity is commonly associated with privilege escalation and token theft.
Detects suspicious cross-process memory operations where a source process requests process creation/write permissions on a target process (e.g., browsers, explorer.exe, or svchost.exe), followed immediately by the execution of a remote thread injection technique such as CreateRemoteThread, QueueUserAPC, or NtCreateThreadEx within the same process pair.
Detects a multi-stage evasion sequence where a process first queries the system for virtualization or sandbox artifacts (e.g., VM tools, system information), followed by an intentional sleep or delay to bypass sandbox analysis, and concluding with subsequent process activity. This pattern is characteristic of malware attempting to detect and evade automated analysis environments.
This rule detects potential process injection or process hollowing attempts by correlating Sysmon Event ID 10 (ProcessAccess) events indicating process memory modification permissions (such as PROCESS_VM_WRITE and PROCESS_CREATE_THREAD) with subsequent Sysmon Event ID 8 (CreateRemoteThread) events targeting the same process. This behavior is indicative of an adversary injecting malicious code into a legitimate host process (e.g., svchost.exe, explorer.exe).
This rule detects cross-process operations where common user applications or scripting hosts initiate activity towards sensitive system processes (e.g., lsass.exe, services.exe). This pattern is a frequent indicator of process injection techniques used to achieve code execution in the context of high-privilege or critical system services, often for the purpose of credential theft or persistence.
Detects the execution of known Living-off-the-Land Binaries (LOLBAS) like mshta, rundll32, regsvr32, and others, when the command line includes indicators of external network retrieval (http/ftp), script execution (javascript/vbscript), or common obfuscation/decoding patterns (base64, encodedcommand). The rule excludes paths within System32 and SysWOW64 to focus on potentially suspicious locations or renamed binaries.
Detects the execution of PsExec by identifying the creation of the PSEXESVC remote service or its associated named pipe. It also identifies renamed or masqueraded PsExec binaries by checking file metadata and provides a mechanism to flag unusual source-to-target host account pairings often associated with lateral movement via SMB/Admin Shares.
Detects Python or Pip processes that download an image file from the network and subsequently write a native extension module (.pyd or .so) to the disk within a 10-minute window. This behavior is consistent with the extraction of a hidden malicious payload embedded within an image file using steganography.
Detects the abuse of the legitimate Windows system binaries regsvr32.exe and rundll32.exe to execute remote scripts or scriptlets, a technique often used to bypass application control and proxy execution of malicious code (similar to Squiblydoo).
Detects instances where a digitally signed executable loads a DLL from a non-standard, user-writable directory (such as Downloads, Desktop, Temp, or AppData). This behavior is characteristic of DLL side-loading, an evasion technique used to execute malicious code by placing a rogue DLL in a location where a legitimate binary might search for its dependencies, often used by threat actors to persist or maintain covert execution.
Page 33 of 864