Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,130 detections
Filters
Last updated
All Time
Detection languages
6,549
6,210
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,130
15,658
12,604
8,415
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects a Go-based backdoor associated with 'The Gentlemen' ransomware group executing commands via cmd.exe. The rule monitors for a specific pattern of WMI UUID queries alongside command-line execution of system discovery tools (whoami, net group, dir) via cmd.exe /c, which is indicative of remote command execution over a Yamux C2 channel.
Detects the execution of Windows file permission management utilities (icacls.exe, cacls.exe, takeown.exe) when multiple instances occur within a short window (5 minutes). This behavior is often associated with ransomware groups preparing systems for encryption by restricting user access to files.
Detects instances where a signed process loads a dynamic-link library (DLL) from a user-writable directory, such as Temp, AppData, Downloads, or Public. This behavior is a common technique used for DLL sideloading to hijack the execution flow of trusted, signed applications.
Detects the clearing of multiple Windows Event Logs using the built-in 'wevtutil.exe' utility. This behavior is often associated with adversaries attempting to remove evidence of their presence or activities by clearing system, security, or application event logs.
Detects potentially unauthorized or malicious Group Policy Object (GPO) modifications and deployment activities. This includes the creation or modification of GPO files on domain controllers (SYSVOL/NETLOGON shares), the use of specific PowerShell scripts associated with GPO deployment, execution of forced group policy updates, and attempts to disable real-time security monitoring via GPO context.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
This rule detects the execution of rundll32.exe where it attempts to load a DLL from common user-writable directories (Temp, AppData, Downloads, Users\Public) and specifically calls the 'Begin' export function. This behavior is often associated with malware attempting to execute malicious code via a legitimate Windows binary.
This rule detects attempts to inject malicious DLLs into common Windows processes such as svchost.exe, explorer.exe, lsass.exe, and winlogon.exe. The detection is based on the loading of DLLs with suspicious names like 'hook.dll', 'inject.dll', 'payload.dll', or 'stage.dll' by these processes, which is indicative of process injection techniques often used by malware like Remcos RAT.
Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
Detects successful sign-ins to specific Azure AD applications known to bypass Conditional Access policies, where Conditional Access was not applied. This could indicate an attempt to circumvent security controls.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions — the value
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects instances of common, sensitive Windows system binaries (svchost.exe, lsass.exe, sms.exe, csrss.exe) being executed by parent processes other than the legitimate system processes (services.exe, smss.exe, csrss.exe, winlogon.exe), indicating potential process masquerading or path spoofing.
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects the execution of VBScript (wscript.exe or cscript.exe) with unusually long command lines containing common obfuscation patterns such as character replacement or string splitting. This pattern is indicative of attempts to hide malicious code from static analysis.
Identifies the SFX module bdzsfx.x64.sfx interacting with security providers to disrupt runtime telemetry.
Detects execution of InvisibleFerret backdoor logic as a Shared Object on macOS.
Detects the sideloading of ark.x64.dll when a legitimate Bandizip.exe is executed from a non-standard path.
Detects a new phone, authenticator application, FIDO key, or passkey registered after account recovery activity, which can establish attacker-controlled multifactor authentication.
Detects registry queries for common virtualization-related artifacts (e.g., VMware, VirtualBox) performed by specific suspicious processes. This behavior is indicative of sandbox or virtual machine evasion techniques used by malware to detect if it is running in an analysis environment before executing its malicious payload.
Page 374 of 864