Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the specific use of RunDll32 to execute shell32.dll ordinal
Consolidated multi-stage detection for the MiniPlasma Local Privilege Escalation (LPE) flaw.
Monitors for unauthorized low-privileged modifications to the NT AUTHORITY\SYSTEM (.DEFAULT) registry hive, anomalous non-system user interaction with the Windows Cloud Files Mini Filter Driver (cldflt.sys), and successful execution of an interactive SYSTEM command shell originating from a non-privileged account context.
Monitors for unauthorized low-privileged modifications to the NT AUTHORITY\SYSTEM (.DEFAULT) registry hive, anomalous non-system user interaction with the Windows Cloud Files Mini Filter Driver (cldflt.sys), and successful execution of an interactive SYSTEM command shell originating from a non-privileged account context.
Detects processes launched with LD_AUDIT or LD_DEBUG style dynamic linker instrumentation, sometimes used to weaken execution guardrails or enable stealthy code paths.
Detects the silent or command-line driven installation of macOS configuration profiles (`profiles install`), which attackers use to bypass security settings or manage device configurations maliciously.
Detects file execution where curl.exe or bitsadmin.exe are copied to a public document folder and renamed to DLL extensions (like winhttp.dll or wininet.dll) to evade detection. This activity is associated with the TAX#TRIDENT campaign.
Detects the execution of wscript.exe targeting a script concealed within an Alternate Data Stream (ADS) in the user profile directory. This technique is heavily used by Gamaredon's GammaWorm for persistence and execution.
Detects regedit.exe being used to import a registry (.reg) file located in the C:\ProgramData\ directory. This technique is utilized in the Nimbus RAT attack chain, where users are socially engineered via Teams to manually import a pre-staged .reg file (e.g., InboxCorePro.reg) to establish persistence on the host.
Detects the usage of the Windows Package Manager (WinGet) to install the Deno runtime environment. Threat actors (e.g., the operators behind the DinDoor backdoor) abuse native package managers to silently install runtimes required for their payloads without triggering alerts.
AppArmor Profile Removed
Cortex XDR
This rule detects attempts to remove AppArmor profiles. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
Identifies wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags, indicative of potential MonoGlyphRAT staging activity.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
Detects execution of svchost.exe from the non-standard \Windows\SysWOW64\msres\ folder. This behavior is associated with the ClientSetup/SyncFuture payload used in the TAX#TRIDENT campaign to maintain C2 sessions.
Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.
Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library.
Threat actors have been observed using DLL sideloading techniques to load malicious payloads under the guise of legitimate applications such as SqlWriter, SqlDumper etc.
Notably, APT29 has been documented leveraging WinELOADER to sideload vcruntime140.dll for executing malicious code.
Threat actors have been observed using DLL sideloading techniques to load malicious payloads under the guise of legitimate applications such as SqlWriter, SqlDumper etc.
Notably, APT29 has been documented leveraging WinELOADER to sideload vcruntime140.dll for executing malicious code.
Detects VSLauncher.exe execution or image loading involving input.dll under SysWOW64, indicative of DLL side-loading by the UAC-0184 threat actor.
Detects modified PAM modules or ELF files implementing PAM backdoors for credential interception, as seen in Ebury and QLNX, whihc uses Rootkit techniques.
Detects the Vampire Bot malware establishing persistence by copying itself to a suspicious directory and using 'attrib.exe' to set system and hidden file attributes.
Detects the execution of hidden payloads within temporary or shared memory directories (/tmp, /var/tmp, /dev/shm). This behavior is commonly associated with the C0XMO Gafgyt botnet variant, which copies itself to these hidden '.sys' files to maintain persistence and evade detection.
Detects the use of sed commands to delete specific competitor botnet entries (e.g., mirai, gafgyt) from system persistence files like crontab or rc.local, a key defense evasion and competitor killing tactic of C0XMO.
Page 473 of 864