Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects various suspicious activities related to privilege escalation and access token manipulation. It identifies the enablement of sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege) by non-system processes, suspicious API calls for token impersonation/duplication (ImpersonateNamedPipeClient, DuplicateTokenEx) from non-privileged processes, and the creation of SYSTEM child processes by medium-integrity parent processes. These behaviors are often indicative of an attacker attempting to elevate privileges on a compromised system.
Detects the creation of hidden Python virtual environments (.venv, .pip) in user directories used to cleanly execute OpenClaw and GhostSocks without system dependencies. This rule specifically looks for 'python.exe' executing with the '-m venv' argument followed by a hidden directory name (starting with a dot) and joins this with file events indicating a folder creation.
Detects instances where the 'consent.exe' process (typically a Windows system utility) loads a DLL named 'msimg32.dll' from a user-writable Temp directory. This behavior is indicative of DLL search order hijacking or side-loading, where an attacker plants a malicious library in a directory that a process prioritizes during the search for dependencies.
Detects executables using Windows system binary names from non-system paths
Detects PowerShell IEX download cradle used for fileless execution
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Detects potential unauthorized or rogue peer connections within a Cisco SD-WAN infrastructure. The rule monitors certificate-based authentication events for indicators of rogue peers (e.g., certificate mismatches, invalid common names) or connections originating from known malicious IP addresses associated with rogue SD-WAN activity.
This rule detects administrative changes to Cisco SD-WAN environments, including policy pushes, template attachments, device onboarding, and tunnel modifications. It uses a risk-scoring mechanism based on the type of change and whether the activity occurs outside of standard business hours (06:00 to 22:00). High-risk events (score >= 65) trigger an alert, highlighting potential unauthorized infrastructure modifications or malicious device insertion.
Detects the installation of a Microsoft Edge extension followed by an outbound network connection to known StegoAd C2 infrastructure after a 3-5 day dormancy period, a behavior characteristic of time-gated sandbox evasion.
Detects the modification of sensitive banking or payment election records (e.g., direct deposit details) in Workday or similar HR SaaS platforms shortly after a user login event from the same source IP. This behavior is consistent with 'Payroll Pirate' style attacks where adversaries use stolen session tokens (via AiTM phishing) to redirect employee salary payments.
Detects the execution of 'consent.exe' from a user-writable temporary directory, specifically patterns associated with Bumblebee malware loading 'msimg32.dll' via DLL side-loading. This activity is often linked to trojanized installers like 'ManageEngine-OpManager.msi'.
This rule detects potentially malicious activity involving System Informer (formerly Process Hacker) or its associated service (phsvc) spawning suspicious child processes like cmd.exe or using rundll32.exe to execute specific DLL-based proofs-of-concept. These patterns are often associated with privilege escalation or evasion techniques using these tools' service drivers.
Detects modifications to the Windows Registry 'AutoConfigURL' setting under 'Internet Settings' initiated by the OpenVPNConnect.exe process. This registry key controls the automatic proxy configuration (PAC file) for the system or user, which can be abused by adversaries to redirect network traffic through a malicious proxy server.
Detects the execution of container-related binaries (act_runner, docker, dockerd) using sensitive command-line flags that indicate potential container escape or high-privilege configuration, such as mounting the host namespace, running in privileged mode, or leaking CI/CD tokens.
Detects suspicious module loads (DLLs) by the Windows Consent UI process (consent.exe) or from an application installation folder in the temporary directory. This pattern is indicative of potential DLL side-loading or hijacking, where an adversary places a malicious DLL in an unexpected location to be loaded by a legitimate process.
Detects blocking of security product reporting to impair defensive capabilities
Detects payloads that check domain membership before executing
Detects creation of hidden user accounts via SpecialAccounts registry key
Detects Gitea Act Runner spawning Docker containers with high-risk security options (e.g., --privileged, --pid=host, --ipc=host, --cap-add=ALL, or security profile unconfined). These flags are often used to attempt a container escape, allowing a process running within a Gitea CI/CD workflow to gain unauthorized access to the underlying host or other container resources.
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Page 376 of 864