Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule looks for a Rust-based stealer that uses Tor for hiding traffic and low-level Linux hooks associated with IronWorm. This malware targets developers through poisoned packages. Linux build servers are at special risk. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule links changes that weaken Windows Defender with a rapid series of network discovery commands. Attackers often turn down protections before mapping the network for ransomware. Treat this sequence as active compromise. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects when a user account repeatedly (3 or more times within an hour) requests either 'SeDebugPrivilege' or 'SeImpersonatePrivilege' (Event ID 4672). This behavior can be indicative of an attacker attempting to escalate privileges or manipulate access tokens, often seen in techniques like token impersonation or debugging processes for malicious purposes.
This rule detects the execution of a VDSO hijacking payload over an SSH connection. It specifically looks for the case-insensitive strings "vdso" and "mmap" within the TCP payload of an established SSH session, indicating an attempt to manipulate the Virtual Dynamic Shared Object (VDSO) for privilege escalation or other malicious purposes.
This rule detects potential Process Doppelganging attempts by looking for specific Windows API calls related to Transactional NTFS (TxF) within HTTP traffic. Specifically, it looks for the presence of "NtCreateTransaction" and "NtCreateSection" in the file data of HTTP responses, indicating a payload that might be attempting to leverage TxF for process creation manipulation.
This rule detects potential process hollowing activity by looking for specific strings in HTTP client-to-server traffic. It triggers if the traffic contains both 'CREATE_SUSPENDED' and 'NtUnmapViewOfSection' (case-insensitive). These strings are indicative of a technique where a legitimate process is created in a suspended state, its memory unmapped, and then malicious code is injected and executed.
This rule detects the presence of a TLS Callback Injection payload in HTTP traffic flowing from the server to the client. It specifically looks for the case-insensitive strings "TlsCallback" and "IMAGE_TLS_DIRECTORY" within the file data of the HTTP response. This technique is often used by malware to achieve code injection and execution.
Detects Hero proxyware artifacts being written or modified within the Windows SysWOW64 directory. Presence of these files may indicate installation of unauthorized proxy services or abuse of enterprise endpoints for traffic relaying.
Detects execution of OneDriveUpdater.exe from C:\ProgramData, which may represent a masqueraded binary attempting to impersonate legitimate Microsoft software. This could indicate an attempt at defense evasion or persistence by an attacker.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Detects the execution of the initial stage DLL payload (endpointdlp.dll) via rundll32.exe calling a specific ordinal (#2) to decrypt and load the final MLTBackdoor payload. This behavior is highly specific to the MLTBackdoor threat.
Detects unexpected outbound network connections from the ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe processes. Threat actors use WinGet DSC execution to establish reverse shells or download payloads. Network activity from these processes is highly unusual.
Detects BITS job configuration files with known persistence mechanisms, such as running at startup
Detects the use of the 'setcap' utility with parameters that assign all Linux capabilities to a binary file. This capability can be abused to create a backdoored binary, enabling unauthorized access, privilege escalation, and bypassing security controls.
This rule detects attempts to abuse the macOS AuthorizationExecuteWithPrivileges function, which allows an application to execute a command with root privileges. The detection is based on the presence of the string "AuthorizationExecuteWithPrivileges" in HTTP response data, indicating a potential attempt by malware or an attacker to escalate privileges on a macOS system.
This rule detects potential PE injection payloads over HTTP by looking for the presence of both "NtUnmapViewOfSection" and "VirtualAllocEx" in the file data. These API calls are commonly used in process injection techniques, specifically for unmapping legitimate sections of a process and allocating new memory for malicious code.
This rule detects the delivery of a payload designed to bypass macOS Transparency, Consent, and Control (TCC) mechanisms via HTTP. Specifically, it looks for the string "kTCCServiceCamera" within HTTP response data, indicating an attempt to manipulate camera access permissions. This activity is often associated with privilege escalation techniques on macOS.
Detects the staging and installation of the G DATA Avk.exe sideloading set within the unexpected C:\Users\Public\GData\ directory, associated with a Mustang Panda PlugX campaign. This rule specifically looks for the creation of files named "Avk.exe", "Avk.dll", or "AVKTray.dat" in this suspicious public user directory.
This rule detects network traffic containing the string "/etc/sudoers" over TCP port 22 (SSH). This could indicate an attempt to modify the sudoers file for privilege escalation, as the sudoers file controls which users can execute commands with superuser privileges.
This rule detects attempts to manipulate the sudo timestamp cache by looking for repeated 'sudo -n' commands within a short timeframe. The 'sudo -n' command allows sudo to run a command without prompting for a password, which can be abused by an attacker to maintain sudo privileges or bypass re-authentication if they have already compromised a user's session. The thresholding mechanism (10 times in 30 seconds from the same source IP) aims to reduce false positives from legitimate, infrequent uses of 'sudo -n' and focus on potential automated or rapid attempts to interact with sudo without password prompts, possibly to keep the timestamp alive or to quickly execute multiple commands.
Page 451 of 864