Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,065 detections
Filters
Last updated
All Time
Detection languages
15,361
13,598
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,115
9,760
3,854
3,760
3,714
Platforms
40,065
7,331
6,542
3,907
3,666
Products / Services
10,442
9,679
6,724
1,888
1,879
MITRE Techniques
13,740
13,120
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects instances of Kerberos Ticket-Granting Ticket (TGT) requests (Event IDs 4768 and 4769) that utilize the legacy RC4 encryption type (0x17). In modern Active Directory environments where AES is the standard for Kerberos, the use of RC4 can be a strong indicator of a Golden Ticket attack or other unauthorized ticket forging activities, as adversaries often force a downgrade to RC4 for easier offline cracking.
Detects modifications to Windows Registry persistence locations (Run, RunOnce, Winlogon Shell/Userinit) where the assigned executable path is located within high-risk directories such as Temp, AppData, or Users Public folders. This is a common technique used by malware for persistence.
Detects modifications to Windows Registry persistence locations (Run, RunOnce, Winlogon Shell/Userinit) where the assigned executable path is located within high-risk directories such as Temp, AppData, or Users Public folders. This is a common technique used by malware for persistence.
Detects the initiation of a new process where the effective user context is SYSTEM, but the originating process was launched by a non-privileged user account. This behavior is indicative of token manipulation techniques such as token impersonation or theft (e.g., via DuplicateTokenEx or ImpersonateLoggedOnUser) to escalate privileges to SYSTEM.
Detects the abuse of built-in Windows binaries 'regsvr32.exe' and 'msbuild.exe' for proxy execution. Specifically, it flags 'regsvr32.exe' loading remote scriptlets via HTTP and 'msbuild.exe' processing project files containing inline tasks, which are common techniques used to execute arbitrary malicious code while bypassing security controls.
Detects suspicious PowerShell process creation patterns often associated with malicious activity. The rule identifies PowerShell execution invoked by common parent processes (like Office applications or scripting engines) or using highly suspicious command-line arguments such as encoded commands, hidden windows, or common download and execution patterns (e.g., IEX, WebClient).
Detects the installation or execution of common remote access tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop) using silent or unattended installation flags. This rule explicitly excludes activity originating from known administrative and management platforms such as Microsoft Intune and SCCM.
Detects attempts to clear or delete Windows Event Logs using common utilities like wevtutil.exe, PowerShell cmdlets, or direct file system deletion of .evtx files.
Detects instances where an unauthorized or non-standard source process performs cross-process access (such as OpenProcess or similar operations indicative of code injection techniques like CreateRemoteThread or QueueUserAPC) against a sensitive target host process, such as explorer.exe, svchost.exe, or notepad.exe.
Detects ClickFix-style social engineering attacks where users are tricked into pasting malicious payloads into the Windows Run dialog. The rule monitors for common scripting interpreters (powershell.exe, cmd.exe, mshta.exe, rundll32.exe) spawned by explorer.exe or mstsc.exe with suspicious command-line patterns indicative of payload delivery, such as obfuscated strings, hidden windows, or short-URL downloads.
This rule detects when common web server processes or service accounts spawn unexpected interpreter, shell, or reconnaissance tools, which is a common indicator of post-exploitation activity following a successful Remote Code Execution (RCE) attempt.
Detects the loading of a legitimately signed but vulnerable driver from suspicious directories (e.g., Temp, Downloads) followed closely by the termination of critical security/EDR service processes. This sequence is indicative of Bring Your Own Vulnerable Driver (BYOVD) exploitation used to disable security controls prior to ransomware deployment.
Detects suspicious outbound HTTPS POST traffic to major generative AI API endpoints (OpenAI, Anthropic, Google) originating from scripting hosts like powershell.exe or python.exe. The detection is triggered by either unusually large outbound payload sizes or the use of unauthorized scripting tools, which is indicative of data exfiltration using AI infrastructure as a relay.
This rule detects the suspicious loading of known vulnerable drivers (Bring Your Own Vulnerable Driver - BYOVD) via the Windows service control manager (sc.exe) or event log 7045, followed by the immediate termination of major endpoint security software processes within a 300-second window. This behavior is indicative of an attempt to disable or tamper with security tools using kernel-level privileges.
Detects the request for DS-Replication-Get-Changes or DS-Replication-Get-Changes-All extended rights on domain objects, which are highly sensitive Active Directory permissions required to perform DCSync attacks to harvest credentials from Domain Controllers.
Detects the creation of scheduled tasks (via Event ID 4698 or schtasks.exe) involving suspicious action paths, encoded PowerShell commands, LOLBins, or tasks configured to run as SYSTEM by non-administrator users, which is a common persistence mechanism for malware.
Detects the creation of scheduled tasks using Event ID 4698 or command-line execution of schtasks.exe. The rule specifically looks for tasks created in suspicious paths such as AppData or ProgramData, or tasks configured to run with highest privileges and/or marked as hidden, which are common indicators of persistence mechanisms used by adversaries.
Detects a suspicious sequence of browser navigation/redirection events followed shortly by the manual execution of command-line utilities (PowerShell, CMD, or MSHTA) via explorer.exe, characteristic of 'ClickFix' social engineering attacks where users are tricked into copying and executing commands from their clipboard.
Detects attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process, a technique commonly used by adversaries to harvest domain credentials and clear-text passwords from memory.
Detects unauthorized processes attempting to open handles to the Local Security Authority Subsystem Service (LSASS) process with access rights consistent with credential dumping (e.g., PROCESS_VM_READ, PROCESS_ALL_ACCESS). This rule also specifically flags the use of well-known tools and techniques such as Mimikatz, ProcDump, and the abuse of rundll32.exe with comsvcs.dll for memory extraction, which is indicative of OS Credential Dumping (T1003.001).
This rule detects persistence mechanisms by monitoring additions to Windows Registry Run keys or files created in the user's Startup directory. It specifically flags entries that target suspicious locations (e.g., Temp, AppData, Public) or attempt to execute encoded commands using PowerShell or CMD.
Page 112 of 1908