Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects Windows Security (1102) or System (104) log clearing events that occur within 30 minutes of privileged activity (new account creation, group membership changes, or service installation) on the same host, sharply reducing false positives versus alerting on log clears alone.
Detects the deployment and activity of the MeshCentral remote management agent (meshagent), including process execution, service creation, and network communication to MeshCentral infrastructure. This behavior is indicative of unauthorized persistence and remote command-and-control, often associated with post-compromise activity such as that observed by ShinyHunters.
Detects the manual enablement of network discovery services (fdrespub, fdPHost, SSDPSRV, upnphost) and the associated Windows Firewall rules. This activity is a known tactic used by Gentlemen ransomware to facilitate lateral movement and network share enumeration by making the compromised host visible to others and allowing it to discover peers.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
Detects attempts by an adversary to disable or clear Windows Event logs using standard administrative utilities such as wevtutil, PowerShell, auditpol, net, sc, or wmic to cover tracks or hinder forensic analysis.
Detects attempts to inhibit system recovery by deleting the Windows backup catalog or modifying boot configuration data to disable automatic repair features using built-in utilities like wbadmin.exe and bcdedit.exe. This activity is commonly associated with ransomware or destructive attacks attempting to prevent system restoration.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog' and 'Remove-EventLog'. Adversaries often perform this action to remove evidence of their presence or malicious activities from a compromised system.
This rule detects the creation of new Windows services that are characteristic of lateral movement tools like PsExec. It looks for services with names typical of PsExec/PAExec, the use of administrative shares (ADMIN$) in image paths, or services with randomly generated names executing from temporary directories (e.g., Windows\Temp, Users\Public). Legitimate administrative tools such as svchost.exe or those within Program Files are excluded.
Detects the use of the bcdedit.exe utility to configure the Windows boot configuration to enter Safe Mode (minimal or with networking), immediately followed by the execution of a shutdown command with the reboot flag. This sequence is a known technique utilized by Akira ransomware affiliates to force a system reboot into a restricted environment where security agents and endpoint detection and response (EDR) tools may fail to load, allowing for undetected encryption.
Detects a burst of lateral movement activity characterized by the use of administrative tools like PsExec or NetExec/CrackMapExec to execute commands or services on multiple distinct target hosts from a single source host within a short window. This pattern is commonly associated with ransomware affiliates or threat actors performing reconnaissance and mass deployment of malicious payloads prior to encryption.
This rule detects potential lateral movement by identifying a system that initiates SMB connections (port 445) to 5 or more unique destinations, correlated with a Windows Service installation event (Event ID 7045) on the host. This behavior is indicative of an adversary or automated tool using SMB to copy and execute binaries as a service on multiple remote systems.
Detects the creation of Windows services by known binary hosts frequently utilized by NeedyMantis for DLL sideloading. This activity is indicative of the persistence phase where the actor's 'is' module registers itself as a service to ensure survival across system reboots following the execution of the sideloading chain.
Detects the loading of the malicious NvFsFilter driver (a BYOVD technique often used by the Rapuncel infostealer) followed immediately by a mass burst of process terminations, indicating an attempt to disable security software.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell where the task binary path resides in suspicious directories frequently used by adversaries for staging, such as AppData, Temp, Downloads, or Public folders.
Detects a multi-stage installation of the Level RMM agent. This rule monitors for a correlation of events including the execution of 'LevelInstaller.exe' with specific installation arguments, file drops in potentially spoofed vendor paths (Dell or Level), the creation of a 'Level' service, and the addition of a 'Level Watchdog' scheduled task on the same device within a 24-hour window.
Detects a significant number of endpoints processing Group Policy computer configurations within a short time window. This activity is indicative of a synchronized event, such as a domain-wide application of a newly modified or deployed Group Policy Object (GPO), which may follow a 'time-bomb' malicious GPO detonation or unauthorized policy change.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Detects evidence of potential adversarial interference with Windows Defender updates and MRT.exe (Malicious Software Removal Tool). The rule correlates high volumes of temporary file creation in user directories with unauthorized access to MRT.exe by third-party processes and repeated Windows Defender update failures, indicating a potential attempt to disrupt endpoint security operations.
Detects the installation or configuration of the NvFsFilter (Alinubx.sys) persistence driver, often associated with malicious behavior that continuously terminates security software processes to allow for persistent unauthorized activity after system reboots.
Detects the installation of a Windows service that mimics the legitimate NVIDIA File System Filter Driver (NvFsFilter). Adversaries, such as those associated with the Rapuncel infostealer, use this technique to establish persistence and evade security controls by masquerading as a common driver component.
Detects the installation of a Windows service where the ImagePath points to a gitlab-runner executable but the ServiceName deviates from the default 'gitlab-runner' name. This technique is often used to mask persistence or evade simple naming-based detections by utilizing the --service flag to rename the runner service.
Page 4 of 61