Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the loading of known vulnerable drivers (rwdrv.sys, hlpdrv.sys) used for potential Bring Your Own Vulnerable Driver (BYOVD) attacks, accompanied by evidence of antivirus tampering through process execution or the creation of suspicious directories related to AV killing utilities.
Detects the installation and operation of the RustDesk remote access tool as a persistent Windows service. This behavior has been identified in the Akira ransomware intrusion chain where adversaries utilize remote access tools for post-compromise persistence and control. The rules monitor for service creation via command-line utilities (sc.exe, PowerShell), registry modifications related to service configurations, and Windows Service Control Manager events (Event ID 7045) that register RustDesk as a persistent system service.
Detects indicators of compromise associated with CVE-2026-45115 in OpenVPN Connect, including suspicious child processes spawned by OpenVPN, the creation of known PoC marker files, and the execution of commands containing exploitation strings related to echo script injection.
Detects the KuinaExtractor UAC bypass technique, which exploits the auto-elevated 'SilentCleanup' scheduled task. The rule identifies suspicious activity via two patterns: the execution of 'cleanmgr.exe' from an unexpected parent process (bypassing normal task scheduler invocation) or the explicit execution of 'schtasks.exe' to trigger the 'SilentCleanup' task.
Modular remote access trojan associated with long-term espionage intrusions
Modular remote access trojan associated with long-term espionage intrusions
Banking trojan and loader using malicious Office macro delivery
Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.
This rule detects potential lateral movement activities by monitoring Windows Event Logs for suspicious network logons combined with service installations typical of post-exploitation tools like Impacket (psexec.py, wmiexec.py, smbexec.py). It flags service names and paths that match known tool patterns, specifically looking for high-frequency lateral movement attempts within a 30-minute window, including specific command-line indicators in service image paths.
This rule monitors for indicators of Impacket toolset usage across multiple data sources, including named pipe access (Event 5145), service creation (Event 7045), scheduled task creation (Event 4698), and process execution (Event 1). It flags suspicious activity associated with modules like secretsdump, wmiexec, psexec, and smbexec, aggregating findings by source host and user to evaluate the breadth of potential unauthorized activity.
This rule detects the creation of a Windows service where the service type is set to 'kernel' via the sc.exe command-line utility. This behavior is indicative of an attempt to load a kernel driver or perform low-level system modifications, which is often used by rootkits or malicious drivers. The rule filters out known trusted publishers to reduce noise.
Detects the use of fltMC.exe to spawn service control commands (sc.exe) or command processor (cmd.exe) with arguments for starting, stopping, creating, deleting, or configuring Windows services. This activity may indicate an attempt to manipulate drivers or services to impair system defenses or achieve persistence.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
This rule detects potential exploitation activity related to CVE-2026-45657 involving the Windows Kernel tcpip.sys driver. It monitors for a combination of system crashes (Kernel-Power 41 or EventLog 6008) correlated with Windows Error Reporting (WER) events referencing 'tcpip.sys', or significant spikes in external authentication attempts occurring shortly before a system crash. The rule aims to identify potential remote code execution attempts manifesting as kernel instability.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects the creation or modification of WMI event subscriptions via EventID 5861 from the Microsoft-Windows-WMI-Activity log. This activity, involving EventFilters, EventConsumers, or FilterToConsumerBindings, is a well-known technique used by adversaries to establish persistence and achieve execution triggered by system events, often resulting in elevated SYSTEM privileges.
Detects attempts to clear Windows event logs using the native 'wevtutil' command-line utility or PowerShell 'Clear-EventLog' command. The rule applies elevated risk levels when the activity is initiated by system-level processes or accounts, which is often indicative of adversary activity attempting to remove forensic evidence of post-exploitation actions.
Page 22 of 61