Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects potential UAC bypass or privilege escalation attempts involving the 'runas' command. The rule identifies suspicious process patterns such as non-standard parent processes invoking runas, self-relaunching applications with elevated command-line flags, and specific executable naming conventions associated with known threat actor activities.
Detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects User Account Control (UAC) bypass attempts where known auto-elevating Windows binaries like fodhelper.exe, eventvwr.exe, or sdclt.exe are used as proxy processes to launch child processes with high integrity without user prompts.
Detects the execution of DcRAT malware by monitoring for the creation of the specific global mutex 'Global\ShitSetupOn26126k' commonly used by this strain to enforce single-instance execution on a host.
Detects sandbox evasion techniques employed by the Gamaredon group using their PteroSand methodology. The rule monitors for WMI queries executed by suspicious parent processes to identify virtualization artifacts (VMware, VirtualBox) or system hardware/system information, which are characteristic of environment reconnaissance and timing-based checks prior to payload activation.
Detects the use of 'unshare' or 'ip' commands by non-root users to manipulate Linux namespaces (e.g., user, network, or xfrm namespaces). These commands can be used to bypass security restrictions, facilitate container escapes, or perform local privilege escalation by exploiting vulnerabilities in the Linux kernel namespace subsystem.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Detects attempts to disable or modify critical Linux security subsystems including SELinux and AppArmor. The rule monitors for the execution of commands such as setenforce, aa-teardown, and systemctl, or direct modifications to security configuration files.
Detects the GIFTEDCROOK malware performing post-execution cleanup using cmd.exe. The malware utilizes a command-line chain consisting of 'timeout' and 'del' to remove staged payloads from C:\ProgramData and persistence shortcuts (.lnk files) from the user's Startup folder after a delay.
Detects the creation of image-related files with generic names in common temporary or user download directories that fall within a specific file size range (100KB-1000KB). These characteristics are often indicative of steganography where malicious payloads or data are embedded within seemingly benign image files to bypass security controls.
Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query, which are indicators of the ErrTraffic webshell activity.
Detects the loading of DLLs with suspicious names ('hook.dll', 'inject.dll', 'logger.dll', 'loader.dll') from common user-writable directories such as 'Temp', 'AppData', or 'Downloads'. These patterns are frequently associated with malware loaders, persistence mechanisms, or unauthorized code injection attempts.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Detects the netsh utility being abused to explicitly open port 3389 in the Windows Defender Firewall to allow inbound RDP traffic.
Detects the execution of 'wevtutil.exe' with the 'cl' or 'clear-log' arguments targeted at primary Windows Event Logs (Security, System, or Application). This activity is commonly associated with an adversary attempting to clear audit logs to conceal malicious actions during an intrusion.
Detects instances where the Windows binary fodhelper.exe spawns various shell or utility processes. This behavior is a common indicator of a User Account Control (UAC) bypass attack, where the attacker leverages the auto-elevation property of fodhelper.exe to execute arbitrary commands with higher privileges.
Detects execution of regsvr32.exe with command line arguments commonly used to execute remote scriptlets (SCT files) via HTTP/HTTPS, bypassing application control by leveraging a trusted Microsoft binary.
Detects the use of cmstp.exe with suspicious command-line arguments (e.g., .inf file references or silent/unattended flags) often associated with bypass of application control or User Account Control (UAC).
Detects powershell.exe executing a hidden .ps1 script from AppData\Local\Temp using character-code string concatenation obfuscation ([char]N+[char]N) and ForEach-Object {[char]$_} patterns, consistent with the TuglaInsaatci/Remcos steganographic loader campaign dropping pmxhtzb4w2q.ps1 for persistence.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
Page 330 of 864