Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the presence and activity of Tailscale VPN, including process execution, command-line arguments, network connections to Tailscale infrastructure, and communications within the Tailscale CGNAT address range (100.64.0.0/10). This rule identifies the potential use of Tailscale for tunneling or remote access, which may be unauthorized in some environments.
This rule detects the use of PsExec or the Service Control Manager (sc.exe) to execute code remotely, which is a common technique used by attackers for lateral movement and remote code execution.
Detects the creation of Windows services initiated by ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This behavior is indicative of the abuse of the Windows Package Manager (WinGet) DSC configuration engine to install persistent malicious services, potentially leveraging PSDscResources.
Detects potential lateral movement activity associated with the SPECTRALVIPER actor by monitoring OneDrive.Sync.Service.exe for the initiation of named pipe connections. The detection specifically targets anomalous orchestration patterns using the XGU::Feature::Pivot Shadow module and XGU::Pivot::StartLink, which utilize named pipes for inter-process communication across systems.
Detects instances where ConfigurationRemotingServer.exe spawns sc.exe, which is indicative of Windows service creation or modification occurring via WinGet Desired State Configuration (DSC) abuse to establish persistence.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
Detects the execution of sc.exe with subcommands 'create' or 'start' where the command line includes a UNC path. This pattern is indicative of an adversary attempting to install or execute a service on a remote host to facilitate lateral movement.
Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.
Detects the creation or configuration of Windows services using sc.exe or PowerShell where the binary path points to suspicious, writable directories (Temp, AppData, or ProgramData). This behavior is often associated with persistence mechanisms where adversaries place malicious binaries in user-writable locations to execute with higher privileges.
Detects attempts to clear Windows event logs using the native command-line utility 'wevtutil' or PowerShell cmdlets 'Clear-EventLog' and 'Remove-EventLog'. Adversaries often perform this action to remove evidence of their activities from security, system, and application logs. The rule includes exclusions for common administrative, backup, and security-related processes to minimize false positives.
Detects the use of native Windows utilities such as shutdown.exe, wmic, powershell, and rundll32 to trigger an immediate system shutdown or restart, which may be indicative of unauthorized system disruption or malicious activity.
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
Detects behaviors associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the dropping of .sys driver files into non-canonical directories, the registration and execution of kernel services via sc.exe, the use of fltMC to load filter drivers, and the loading of driver modules from non-standard locations.
Detects execution of Windows utilities used by the TrymeLocker ransomware to inhibit system recovery, including disabling boot recovery features via bcdedit, clearing backup catalogs via wbadmin, deleting volume shadow copies via vssadmin or wmic, and disabling the Windows Recovery Environment via reagentc.
Detects multiple concurrent attempts to inhibit Windows system recovery, a common behavior observed in the TrymeLocker ransomware family. The rule triggers when at least two distinct malicious activities occur on the same host within a 120-second window, including the disabling of the Windows Recovery Environment (WinRE) via bcdedit, deletion of shadow copies via vssadmin or wmic, disabling of the Windows backup service (wbengine) via sc, or disabling of System Restore via registry modification.
Detects unauthorized attempts to terminate, stop, or access Endpoint Detection and Response (EDR) or Antivirus agent processes. This is identified by monitoring command-line utilities like taskkill, net, and sc targeting known security service names, as well as detecting suspicious cross-process access (e.g., OpenProcess) by unauthorized processes targeting security agent PIDs.
Detects the creation, reading, or execution of payloads stored within NTFS Alternate Data Streams (ADS). This technique is commonly used by adversaries to hide malicious content within file metadata to evade security tools. The rule monitors process command-line arguments for ADS syntax, identifies usage of utilities like type, Get-Content, wmic, or various LOLBins (e.g., regsvr32, rundll32) interacting with ADS paths, and flags anomalous file creation/modification events that involve ADS, excluding known system-generated streams.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
This rule detects potential exploitation activity related to CVE-2026-45657 involving the Windows Kernel tcpip.sys driver. It monitors for a combination of system crashes (Kernel-Power 41 or EventLog 6008) correlated with Windows Error Reporting (WER) events referencing 'tcpip.sys', or significant spikes in external authentication attempts occurring shortly before a system crash. The rule aims to identify potential remote code execution attempts manifesting as kernel instability.
Detects attempts to disable Microsoft Defender security features. The rule monitors for PowerShell cmdlets (Set-MpPreference), service control operations (sc.exe stopping WinDefend), and registry modifications to the 'DisableAntiSpyware' policy key, which are common methods used by adversaries to impair host-based security defenses.
Detects the creation of virtual machines or the attachment of virtual hard disks (VHDs) using Hyper-V management tools, PowerShell, or Windows Disk Management utilities. This activity is often associated with efforts to bypass endpoint security monitoring by executing payloads within an unmanaged guest VM environment.
Page 25 of 61