Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail).
This rule detects the execution of PowerShell with parameters indicating an attempt to elevate privileges using 'Start-Process -Verb RunAs'. This technique can be used to bypass User Account Control (UAC) and execute commands with administrative privileges.
Detects the execution of wscript.exe with the /elevated argument, where the process was spawned by another wscript.exe instance. This behavior is indicative of potential malicious script execution attempting to bypass normal user execution constraints or using techniques to maintain elevation, often associated with living-off-the-land binaries.
Detects LCRYX ransomware or similar malicious scripts using wscript.exe or cscript.exe to disable Windows security features and system controls via registry modifications, such as disabling UAC, Task Manager, and Registry Tools.
This rule detects the execution of PowerShell or batch scripts that mimic legitimate Realtek audio services, a known tactic used by AsyncRAT. Specifically, it looks for process command lines containing "RealtekAudioService64.ps1", "RealtekAudioService64.bat", "RealtekAudioEnhancements64.ahk", or "RtkNGUI64.ahk".
This rule detects the creation of 'system.dll' or 'shfolder.dll' files within Windows or AppData temporary directories. These specific filenames are frequently associated with DLL sideloading or search order hijacking techniques where malicious DLLs are masqueraded or placed in writable user-space folders for execution by legitimate processes.
Detects registration of new MFA devices potentially for authentication bypass
Detects ffmpeg or ffprobe spawning unexpected child processes such as /bin/sh as a result of the MagicYUV OOB write hijacking the AVBuffer.free function pointer to call system() — a key indicator of CVE-2026-8461 exploitation.
Detects process parent ID (PPID) spoofing where a process spawned by SystemSettings.exe claims a parent that is not SystemSettings.exe, svchost.exe, services.exe, or explorer.exe. This behavior is indicative of SharkLoader attempting to disguise Cobalt Strike Beacon process lineage using UpdateProcThreadAttribute/PROC_THREAD_ATTRIBUTE_PARENT_PROCESS. The rule also looks for suspicious process paths associated with SharkLoader.
Detects attempts to stop, disable, delete, or configure the Sysmon service using standard administrative utilities (sc.exe, taskkill.exe, or PowerShell). Attackers often perform these actions to blind defensive visibility before executing further malicious activity.
Detects the creation of a suspicious file (script or executable) within common web directories (inetpub or wwwroot) followed by an attempt to timestomp that file using common tools like PowerShell, Rundll32, or dedicated timestomping binaries within a 30-minute window. This behavior is indicative of an attacker attempting to establish persistence via a web shell while concealing the activity by modifying file timestamps.
This rule detects unauthorized attempts to disable Microsoft Defender Antivirus features using the Set-MpPreference PowerShell cmdlet. By monitoring the command line arguments for multiple disable flags (such as -DisableRealtimeMonitoring, -DisableBehaviorMonitoring, etc.), the rule flags activity where an attacker or unauthorized user is attempting to impair host-based security defenses.
Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.
Detects modification or replacement of a trusted-looking executable or DLL located in a directory writable by standard users. This rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file is an executable (.exe) or dynamic link library (.dll) and is located in common world-writable directories such as \Users\Public\, \ProgramData\, \AppData\, or \Temp\. Additionally, it filters for processes whose command line or base file name suggests a loader, updater, or common command-line utilities (cmd.exe, powershell.exe) initiating these writes, indicating potential masquerading or DLL hijacking.
Detects regsvr32.exe loading DLLs from user-writable directories such as Temp, AppData, ProgramData, Downloads, Desktop, and Public. Legitimate DLL registration runs from System32 or Program Files - execution from these paths indicates LOLBin abuse for proxy execution, DLL sideloading, or defense evasion commonly used to launch malware payloads.
Detects cleanup of captured frames, QR images, overlay resources, or decrypted modules after a banking fraud session, specifically targeting files with names containing 'screen', 'frame', 'overlay', 'qr', 'module', or 'stage' and extensions like '.png', '.jpg', '.bmp', '.dll', '.dat', '.bin' within common temporary or application data directories. The activity is attributed to processes with 'banana', 'client', 'update', or 'service' in their base file name.
This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.
Detects the use of certutil.exe with command-line arguments indicative of downloading files from a URL or decoding/encoding data. This utility is often abused by adversaries for ingress tool transfer or obfuscation.
This rule detects attempts to tamper with critical Linux log files such as /var/log/auth.log, /var/log/syslog, and /var/log/audit/audit.log. It specifically looks for file deletion or modification events, or process creation events that involve commands like 'rm', 'shred', 'truncate', 'unlink', or 'dd' targeting these log files. Legitimate processes like 'logrotate', 'rsyslog', 'syslog-ng', 'auditd', 'systemd', and 'journald' are excluded to reduce false positives.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.
Page 368 of 864