Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE.
The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers.
Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors
to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response
The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers.
Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors
to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response
Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.
Detects when a user enables DNS-over-HTTPS.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability
Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll
Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Detects the CTRL persistence pattern by correlating suspicious registry value modifications (using disguised names like 'ShellStateVersion1', 'IconSizeVersion1', 'IconUnderlineVersion1') with the creation of scheduled tasks via PowerShell or schtasks.exe. The scheduled tasks often involve hidden or encoded commands and are set to launch at startup or with specific system privileges.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
Detects when a registered security product on a Windows system has been turned off or snoozed, indicated by Windows Security Center Event ID 15 with specific states.
Detects Windows Security Center Event ID 15 indicating that a registered security product, such as Windows Defender or VIPRE, has been turned off or snoozed. Attackers actively uninstall or disable endpoint security agents immediately prior to deploying ransomware to ensure successful encryption without interference.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Detects execution of AnyDesk on Windows endpoints. Adversaries may use legitimate remote access tools to obtain interactive access and to maintain persistence after initial compromise.
An attacker disables or weakens Windows auditing to reduce the visibility of system and user activity. This helps evade detection by security tools and analysts by preventing critical events from being recorded in Windows Event Logs.
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
Detects a sequence where a service terminates unexpectedly, followed immediately by a process creation from the Service Control Manager (services.exe). This pattern can indicate that a service's recovery options have been configured to run a malicious program upon failure.
Detects the usage of Reg.Exe to query system language settings.
Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,
or avoid targeting certain locales to evade detection.
Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,
or avoid targeting certain locales to evade detection.
This rule detects attempts at command injection within the username field during authentication on Palo Alto firewalls. It specifically looks for patterns indicative of shell injection, including backtick-wrapped payloads (relevant to CVE-2024-9474), command separators like ';', '&&', '||', command substitution using '$()', directory traversal attempts ('../', './'), and the presence of common command-line utilities such as 'wget', 'curl', 'chmod', 'sh', 'bash', and 'nc' within the authentication message. The detection is based on system logs that record user authentication attempts.
Page 39 of 61