Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
This rule detects an unusually high volume (10 or more within an hour) of permission changes to files or registry keys by a single user. This activity can be indicative of an adversary attempting to modify access controls to facilitate persistence, privilege escalation, or defense evasion.
Detects the creation or modification of the non-standard registry key (ms-pu\CLSID) used by the Mustang Panda PlugX variant to store its 16-character hex client identifier. This specific registry path is highly indicative of PlugX activity.
Detects exploitation of weak service file permissions for privilege escalation
Detects use of CreateProcessWithTokenW for spawning elevated processes
Detects modification of hybrid identity federation configuration for authentication bypass
Detects use of stolen legitimate code signing certificates on suspicious binaries
Detects Office documents fetching remote templates for template injection attacks
Detects parent process ID spoofing used to hide malicious process relationships
Detects modification of network device system images via TFTP for persistent backdoors
Detects reuse of alternate authentication materials like tokens or cookies
Detects registry modifications designed to disable automatic system reboots and scheduled maintenance, preventing the system from interrupting destructive actions, as observed with BLUERABBIT.
Detects port knocking sequences used to activate hidden network backdoors
Detects download of tools designed to bypass Windows trust control mechanisms
Detects SVG files embedding base64 executables for HTML smuggling
Detects system scripts like PubPrn used as execution proxies for defense evasion
Detects exploitation of weak service registry ACLs for privilege persistence
Detects remote modification of file and directory permissions via SMB
Detects signed Windows binaries abused as execution proxies for defense evasion
Detects malware using debugger detection APIs to evade dynamic analysis
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
Page 449 of 864