Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This rule detects the delivery of a payload associated with a COR_PROFILER DLL hijacking technique. It specifically looks for HTTP traffic flowing to the client that contains both the string "COR_PROFILER" and the file extension ".dll" (case-insensitive) within the file data. This indicates an attempt to deliver a malicious DLL that could be used for persistence or privilege escalation by exploiting the COR_PROFILER environment variable.
This rule detects attempts to disable Conditional Access Policies in Microsoft 365 via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' targeting the 'conditionalAccess/policies' endpoint. Such activity could indicate an attacker attempting to bypass security controls for persistence or privilege escalation.
This rule detects attempts to modify or delete Multi-Factor Authentication (MFA) provider configurations via the Microsoft Graph API. Specifically, it looks for HTTP DELETE requests to 'graph.microsoft.com' with a URI containing 'authentication'. This activity could indicate an attacker attempting to disable or alter MFA settings to gain unauthorized access or maintain persistence.
Detects the creation of the specific named pipe '\REDSUN' used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This named pipe is a unique indicator of the RedSun exploit's activity, often associated with process injection or other inter-process communication mechanisms.
Detects PowerShell or pwsh.exe processes being launched with the '-windowstyle hidden' or '-w hidden' or '-window hidden' command-line arguments. This technique is often used by adversaries to conceal their activity from users.
Detects the loading of UnityPlayer.dll from unexpected paths such as Temp or WebViewFixUtility. This behavior indicates potential DLL sideloading, as observed in Operation Dragon Weave, where RuntimeBroker_update.exe or BrowserViewUtility.exe loads a malicious UnityPlayer.dll (Rustcloak) to execute the Azureveil payload.
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This behavior is associated with the SStar Agent RAT's remote 'type' functionality.
MiniPlasma Registry Modification
Cortex XDR
This rule detects attempts to create or modify registry keys or values within the '.DEFAULT\Volatile Environment' path or 'Software\Policies\Microsoft\CloudFiles\BlockedApps'. Modifications to these keys can be indicator of the MiniPlasma privilege escalation technique
This rule detects potential cloud API access using a stolen token by monitoring HTTP requests to AWS S3, Azure management, or Google APIs that contain an 'Authorization: Bearer' header. A threshold of 50 such requests within 10 seconds from the same source IP triggers the alert, indicating a possible brute-force or high-volume access attempt with a compromised token.
This rule detects HTTP POST requests to common cloud console login pages (AWS, Microsoft Azure, Google Cloud) that originate from a suspicious IP range. The rule uses a threshold of 5 attempts within 30 seconds from the same source IP to trigger an alert, indicating potential brute-force or credential stuffing attacks against cloud accounts.
Detects the loading of a malicious DLL by explorer.exe. This DLL is responsible for extracting a shellcode payload from a PNG file using steganography, a technique observed in the APT28 Phantom Net Voxel campaign.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the modification of Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) designed to conceal files and file extensions. This defense evasion technique is notably used by the Gamaredon group's GammaWorm to hide dropped payloads, replaced LNK files, and malicious directories.
Detects PowerShell utilizing Invoke-WebRequest (iwr) to download a payload and subsequently executing it via Start-Process using rundll32 with the specific 'Begin' export function. This execution pattern is the primary secondary stage for the recent Ghost CMS ClickFix campaigns delivering information stealers.
Sudo Caching and Elevation Abuse
Gravwell
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of ConvertTo-SecureString alongside the HKCU:\Printers path. This technique is used by Gamaredon to bind payload encryption to the active user session and hinder forensic analysis.
Detects processes modifying or querying Windows Defender registry keys related to Potentially Unwanted Application (PUA) protection (PUAProtection, MpEnablePus). This behavior is observed in the SessionGate malware to verify its execution environment and evade detection before deploying further payloads.
Detects the execution of 'active_desktop_launcher.exe' (a legitimate signed KuGou binary) from unusual directories like ProgramData or AppData\Local\Temp. This behavior indicates potential DLL side-loading staging by the BoldTealLayer malware prior to executing its in-memory evasion chain.
Detects Atlas RAT anti-analysis behavior by monitoring for interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This is a known sandbox evasion technique used by TA4922 before executing its primary payload.
Page 469 of 864