Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects HTTP responses containing SVG (Scalable Vector Graphics) content that also embeds base64 encoded data starting with 'TVQAA'. This specific sequence ('TVQAA') is characteristic of a base64 encoded Windows executable (MZ header). The rule aims to identify a technique known as SVG smuggling, where malicious executables are hidden within SVG files and delivered to clients, often as a defense evasion tactic.
This rule detects attempts to remotely disable the Windows Event Log service over SMB (port 445). It specifically looks for TCP traffic to port 445 on the home network, containing the case-insensitive strings "EventLog" and "StopService". This activity is indicative of an attacker trying to hinder forensic analysis or evade detection by stopping logging services.
This rule detects HTTP responses that contain a URI with a double extension, where the first extension is a common document or image file type (doc, pdf, jpg, png, txt) and the second extension is an executable or script file type (exe, bat, vbs, ps1, cmd). This pattern is often used in file masquerading to trick users into executing malicious files.
This rule detects attempts to submit a Dockerfile containing 'FROM' and 'RUN' instructions to the Docker API via an HTTP POST request to the '/build' endpoint. This activity could indicate an attacker attempting to build a malicious Docker image on a compromised Docker host.
This rule detects attempts to modify macOS Plist files over an SSH connection. Specifically, it looks for TCP traffic on port 22 (SSH) where the payload contains both '/Library/Preferences/' and '.plist' (case-insensitive). This activity is flagged as potential defense evasion, as modifying Plist files can be used to alter system behavior or application settings to evade security mechanisms.
This rule detects the delivery of a CMSTP INF file over HTTP that contains specific content indicative of a User Account Control (UAC) bypass attempt. It looks for HTTP responses containing a URI with ".inf", and within the file data, the strings "[DefaultInstall]" and "RegisterOCXs". This combination suggests an attempt to leverage CMSTP (Connection Manager Profile Installer) to execute arbitrary code, often used by adversaries for defense evasion and privilege escalation.
This rule detects the download of a Microsoft Management Console (MMC) snap-in file (.msc) over HTTP that also contains the string "MMCVersion". This combination is often used by attackers to execute malicious code or establish persistence, leveraging the trusted nature of MMC snap-ins. The rule specifically looks for the file extension in the URI and the 'MMCVersion' string within the file's data, indicating a potential malicious MMC snap-in being delivered via HTTP.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
Detects when a Network Security Group (NSG) rule is successfully deleted in Azure. This could indicate an attempt to bypass network access controls, potentially to enable unauthorized access or exfiltration.
This rule detects when a single caller successfully updates three or more SQL Server firewall rules within a one-hour window. This behavior could indicate an adversary attempting to open up network access to a SQL database, potentially for data exfiltration, command and control, or further lateral movement.
This rule detects the spawning of a root shell from specific SUID binaries (su, sudo, doas, passwd, chsh) when the initiating process was run by an unprivileged user. This behavior is indicative of a privilege escalation exploit, potentially related to CVE-2026-45257 (BUMSRAKETE).
Detects Windows Error Reporting (Event ID 1000) events associated with lsass.exe crashes. Memory corruption exploits, such as CVE-2026-41089 (Netlogon RCE), often cause service instability. Monitoring for lsass.exe crashes can reveal failed exploitation attempts or other critical system issues.
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
Detects WindowsPackageManagerServer.exe launching with the '--manualActivation' flag. This behavior is indicative of the DSCourier COM API abuse technique, which bypasses the standard winget.exe binary to execute malicious Desired State Configuration (DSC) payloads stealthily.
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
This rule detects the delivery of a Linux ptrace injection tool via HTTP. It specifically looks for the string "ptrace(PTRACE_ATTACH" within HTTP response data, indicating that a file containing this specific ptrace function call is being sent to a client. This technique is often used for process injection and privilege escalation on Linux systems.
This rule identifies recurring antivirus detections on endpoints, specifically filtering out common false positives originating from browser cache directories. It aggregates detections by device, threat name, and device ID, and flags instances where the same threat has been detected on at least two distinct days within a 30-day lookback period. This helps to highlight persistent malware issues rather than transient or benign detections.
Detects the creation of the '.bun_ran' run-once marker in a temporary directory or suspicious Python '.pth' startup hooks (e.g., 'langchain_core-setup.pth') indicative of the Hades loader variant. The '.bun_ran' file acts as a marker for the loader, while '.pth' files can be used to inject malicious code into Python's import mechanism, achieving persistence or execution.
This rule detects suspicious execution of 'RUNDLL32.EXE' with specific command-line arguments. It looks for instances where 'RUNDLL32.EXE' is executed with both a backslash and a comma in the command line, combined with specific DLL names or keywords like 'iamnotarobot.dll', 'checkme.dll', 'machinerie.dll', 'humanCheck', or 'verifyme'. This pattern is often indicative of malicious DLL loading or persistence mechanisms.
This rule detects suspicious activity where a user successfully performs a multi-factor authentication (MFA) device login to Microsoft Office 365 via a browser, and within a 15-minute window, the same user either creates a new inbox rule or adds a new device. This combination of events could indicate an adversary gaining initial access and then setting up persistence (e.g., forwarding emails) or further device enrollment.
Page 440 of 864