Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects COR_PROFILER environment variable abuse for .NET DLL hijacking
Detects modification of PATH environment variable for binary hijacking
Detects executables signed with invalid or self-signed certificates for masquerading
Detects bcdedit modification to boot in safe mode to bypass security tools
Detects KernelCallbackTable manipulation for process injection via kernel callback
Detects reflective DLL loading technique that avoids writing files to disk
Detects commands used to disable or impair security defenses
Detects exploitation of unquoted service paths via SMB file placement
Detects fileless malware storing payloads in registry keys for evasion
Detects legitimate system binaries renamed to evade detection
Detects raw disk volume access used to bypass file system security controls
Detects modification of cloud compute infrastructure to evade detection or remove evidence
Detects commands used to reflash component firmware for deep persistence
Detects PowerShell command obfuscation techniques used to evade detection
Detects LD_PRELOAD environment variable set to load malicious shared libraries
Detects base64 encoded payloads in HTTP request bodies indicating obfuscation
Detects creation of Intune device management scripts, a potential privilege abuse vector.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic containing specific API calls often used by malware to determine if it's running in a sandboxed environment. Specifically, it looks for the 'GetForegroundWindow' function, which retrieves a handle to the foreground window, and the 'Sleep' function, which can be used to delay execution and bypass time-based sandbox analysis. The combination of these two indicates an attempt to check for user interaction and evade detection.
This rule detects attempts to perform raw disk access via SSH, specifically looking for the 'dd if=/dev/sd' command within SSH traffic. This activity could indicate an attacker trying to bypass volume-based security controls or exfiltrate data directly from disk partitions.
This rule detects HTTP responses (flow:to_client) that contain specific strings indicative of an environment-keyed payload checking the domain before execution. Specifically, it looks for the case-insensitive strings "GetComputerNameEx" and "NetworkDomain" within the file data of the HTTP response. This behavior is often associated with malware attempting to determine its execution environment to evade analysis or target specific systems.
This rule detects HTTP requests where the URI contains the string "%comspec%" (case-insensitive). This pattern is often used by attackers to obfuscate command execution, specifically by referencing the command interpreter (cmd.exe) via an environment variable, as part of defense evasion tactics. The rule is specifically looking for this string within the URI of an HTTP request flowing from the internal network to an external server.
Page 442 of 864