Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Targets rundll32 calling a Begin export from a DLL staged in Temp or AppData. The UDM rule retains principal and target context for correlation.
Targets creation or loading of a .sys file from the Fonts directory by a non-standard loader. The UDM rule retains principal and target context for correlation.
Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.
Targets symbolic link, junction, or reparse-point operations against Defender quarantine, platform, or scan paths. The UDM rule retains principal and target context for correlation.
This rule detects the loading of 'tpsvcloc.dll' from the 'Windows\Fonts' directory by a process associated with ThinPrint. This behavior is indicative of DLL sideloading, where a malicious DLL is placed in a location that a legitimate application (ThinPrint in this case) will load, allowing for arbitrary code execution. The rule specifically looks for image load events where the module name is 'tpsvcloc.dll', the module path is within 'Windows\Fonts', and the actor process image path contains 'thinprint', 'tpsvc', or 'tp*.exe'.
Defender exclusion for the Hola path
Cortex XDR
This rule detects attempts to modify Windows Defender preferences to exclude the Hola application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun that include 'add-mppreference', 'exclusion', and 'hola' keywords, indicating an attempt to bypass antivirus scanning for the Hola application.
This rule detects the creation of a Run key or login persistence entry by an Electron or Node.js process, where the persistent application is located within the AppData\Local directory. It specifically looks for registry modifications that establish persistence for executables in user-specific application data folders, often indicative of malware or unwanted applications.
Detects files using double extensions to disguise executable payloads
Detects the use of the New-NetQosPolicy PowerShell cmdlet with parameters designed to aggressively throttle application bandwidth. Attackers can utilize this technique to restrict EDR agent bandwidth to near zero, causing server timeouts while avoiding explicit process termination and bypassing standard WFP tampering alerts.
Detects attempts to unload, disable, or remove kernel drivers, which could indicate a rootkit or other malicious activity trying to hide its presence or impair system defenses. The rule specifically looks for process creation events (EventID 4688) where the command line contains keywords related to driver manipulation ('unload driver', 'disable driver', 'remove driver') and also references kernel components ('.sys', 'kernel').
This rule detects potential multi-factor authentication (MFA) bypass attempts for privileged accounts. It identifies instances where an administrative user attempts 10 or more sign-ins from 3 or more unique devices within a 5-minute window, specifically when the authentication method is 'Push notification to app' and the result type is '0' (success). This behavior could indicate an adversary attempting to bypass MFA for a privileged account.
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects repeated failed or successful logon attempts (EventID 4625 or 4624) to sensitive system accounts like 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', or 'ADMIN$' from non-system accounts. It specifically looks for interactive (LogonType 10), remote interactive (LogonType 3), or unlock (LogonType 9) logons, and triggers if there are 3 or more such attempts within an hour for the same account and computer.
This rule detects suspicious command-line activity related to Duo Security administration. It looks for processes executing with 'duo_client', 'duo_admin', or 'duo_api' in their command line, combined with sensitive parameters like '--admin-api', '--key', '--secret', or 'token'. The rule specifically excludes processes spawned by 'powershell.exe' or 'cmd.exe' to reduce noise, and triggers if such activity occurs at least twice within an hour on the same computer by the same user. This could indicate an attempt to manipulate Duo Security configurations, potentially to bypass multi-factor authentication.
Identifies payload loading malicious SbieDll.dll from an anomalous path.
This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.
This rule detects modifications to critical boot sector files (bootsect, bootmgr, BOOTCODE, MBR) on the C: or X: drives. It specifically looks for these modifications when initiated by processes other than common system processes like 'system', 'csrss.exe', or 'explorer.exe'. The rule counts modifications within one-hour bins and triggers if one or more modifications are observed.
This rule detects potential process injection attempts by monitoring Windows Security Event ID 4688 (A new process has been created) for specific keywords in the command line. The keywords 'CreateRemoteThread', 'WriteProcessMemory', 'VirtualAllocEx', 'SetWindowsHookEx', and 'LoadLibrary' are commonly associated with various process injection techniques. The rule summarizes these attempts by computer, user, and hourly intervals.
Detects proxy execution of the Vidar secondary payload (agt.dll) using rundll32.exe, specifically targeting behaviors observed in the Operation Turb00 campaign. This rule identifies instances where rundll32.exe is used to load 'agt.dll', which is a known indicator for Vidar malware.
Identifies 'setup.exe' originating from a 'Hiring Portal' directory loading the 'UpdateChecker.dll'. This behavior is indicative of DLL sideloading, a technique used by the 'Screening Serpens' APT group.
Detects malicious .config modifications suppressing ETW telemetry and bypassing strong name verification, indicative of the Screening Serpens activity. The rule specifically looks for file modifications to .config files that include specific strings related to disabling ETW and bypassing strong name verification, combined with process command line arguments containing these same strings.
Page 425 of 864