Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects EWM injection using SetWindowLongPtr API for code execution
Detects Verclsid used for COM object verification as proxy execution
Detects installation of root certificates to enable MITM interception
Detects suspicious Azure PIM role activation requests for temporary elevated access
This rule detects network traffic containing the strings "CreateProcessWithTokenW" and "MAXIMUM_ALLOWED" in HTTP client data. This combination of strings is indicative of a payload attempting a privilege escalation technique, specifically leveraging the Windows API function CreateProcessWithTokenW, often used in conjunction with token manipulation to achieve higher privileges. The `flow:to_client` indicates that the payload is being sent from the server to the client, suggesting a potential download or response containing the malicious code.
This rule detects attempts to perform remote DLL injection via UNC path writes over SMB. It specifically looks for SMB traffic to port 445 on the home network, containing ".dll", "\\", and "System32" in a case-insensitive manner. This combination suggests an attempt to write a DLL file to a System32 directory on a remote machine using a UNC path, which is a common technique for DLL injection.
This rule detects attempts to create a setuid binary on a remote host via an SSH connection. It specifically looks for the string "chmod u+s" within TCP traffic destined for port 22 (SSH), indicating a command to set the setuid bit on a file. This activity is often associated with privilege escalation attempts where an attacker tries to create a backdoor or maintain persistence with elevated privileges.
This rule detects potential parent PID spoofing attempts by monitoring HTTP traffic for the presence of specific Windows API calls related to process creation and attribute modification. Specifically, it looks for 'UpdateProcThreadAttribute' and 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' in the file data of HTTP responses, indicating that a client might be receiving instructions or code to perform parent PID spoofing.
This rule detects an unusually high volume (5 or more within an hour) of successful logons by 'SYSTEM' or 'LOCAL SERVICE' accounts. While these are legitimate system accounts, a sudden surge in their logon activity could indicate unusual system behavior, potential compromise, or misconfiguration leading to excessive system account usage.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
This rule detects HTTP requests containing multiple common HTTP header names (X-Forwarded-For, X-Real-IP, X-Originating-IP) in the 'http.header_names' field. This pattern is often associated with attempts to bypass Web Application Firewalls (WAFs) or other security devices by injecting junk or spoofed headers to confuse or misdirect them.
Detects the execution of mshta.exe with command-line arguments that indicate the execution of JavaScript or VBScript code, often used for malicious purposes such as bypassing application whitelisting or executing remote code.
Detects the execution of rundll32.exe with command-line arguments indicative of running an HTML Application (mshtml,RunHTMLApplication) or directly executing JavaScript. This technique is often used by adversaries for code execution and bypassing security controls.
Detects the deletion of staging artifacts using cmd.exe and the timeout command, a technique used by result.dll (GIFTEDCROOK) for self-deletion after exfiltration. This rule specifically looks for command-line patterns indicative of a delayed file deletion, often used by malware to remove its traces.
Detects the execution of Windows processes where the parent process is wsl.exe. This indicates WSL interop functionality being used to execute host-side binaries from within the Linux environment, a technique often used to trigger staged payloads.
Detects the specific command-line sequence utilized by the SHEETCREEP dropper to delete itself (melt) and hide forensic traces using cmd.exe. This involves a delayed deletion using 'choice' and 'del /f /q' commands.
Process Data as source
File running from Recycle Bin
File running from Recycle Bin
This rule detects potential sandbox evasion techniques by identifying HTTP traffic (specifically client-to-server responses) that contains both 'GetCursorPos' and 'Sleep' within the file data. This combination is often used by malware to check for user interaction (mouse movement) and introduce delays, which can indicate an attempt to determine if it's running in a sandboxed environment.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of malware attempting to prevent double execution using mutexes. It looks for the strings "CreateMutex" and "ALREADY_EXISTS" (case-insensitive) within the file data of the HTTP response. This behavior is common in malware to ensure only one instance of itself is running on a system, often as a defense evasion technique.
This rule detects the download of executable files (EXE, DLL, BIN) over HTTP that appear to be stripped of their standard headers. It specifically looks for the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, but then implies a lack of full header structure by the 'Stripped Executable Payload Without Headers' message. The rule also requires the file size to be greater than 10000 bytes.
Page 439 of 864