Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
368 detections
Filters
Last updated
All Time
Detection languages
165
76
61
21
19
Contributors
104
64
59
35
30
Categories
109
79
71
56
40
Platforms
349
9
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
368
MITRE Techniques
128
87
68
40
36
CVEs
7
5
5
2
2
IDS Classtypes
1
IDS Protocols
1
Detects modifications to the Outlook Security registry key, specifically setting the 'Level' value to '1'. This configuration (often associated with 'OutlookSecurityMode' or related programmatic access policies) can be used by adversaries to bypass security prompts when accessing the Outlook Object Model, allowing malicious scripts or applications to interact with Outlook to send emails, harvest contacts, or access attachments without user intervention.
Detects modifications to Windows Registry keys associated with Event Tracing for Windows (ETW) Autologger configurations or Event Log service configurations. These modifications can be used by adversaries to disable or tamper with event logging mechanisms, effectively blinding security telemetry and evading detection.
This rule detects potential malicious activity associated with the 'CadenceOptimizer' service and related 'agt.dll' library. It monitors for the creation or modification of Windows Registry keys for persistence, the creation or loading of a specific DLL in the 'ProgramData\CorsairUtil' directory, and the injection of code into 'svchost.exe' via 'Brn_Agent' command line arguments.
Detects potential lateral movement activity associated with the SPECTRALVIPER actor by monitoring OneDrive.Sync.Service.exe for the initiation of named pipe connections. The detection specifically targets anomalous orchestration patterns using the XGU::Feature::Pivot Shadow module and XGU::Pivot::StartLink, which utilize named pipes for inter-process communication across systems.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
Detects attempts to clear Windows event logs using the native command-line utility 'wevtutil' or PowerShell cmdlets 'Clear-EventLog' and 'Remove-EventLog'. Adversaries often perform this action to remove evidence of their activities from security, system, and application logs. The rule includes exclusions for common administrative, backup, and security-related processes to minimize false positives.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
This rule detects potential exploitation activity related to CVE-2026-45657 involving the Windows Kernel tcpip.sys driver. It monitors for a combination of system crashes (Kernel-Power 41 or EventLog 6008) correlated with Windows Error Reporting (WER) events referencing 'tcpip.sys', or significant spikes in external authentication attempts occurring shortly before a system crash. The rule aims to identify potential remote code execution attempts manifesting as kernel instability.
Detects attempts to clear Windows Event Logs using wevtutil or PowerShell, and the suspicious deletion of files in sensitive directories (AppData, ProgramData, Temp, Users) using the command prompt. These behaviors are commonly associated with anti-forensics and data destruction activities used by adversaries to hide their tracks during an intrusion.
Detects usage of the Windows Event Utility (wevtutil.exe) with the 'cl' command-line flag, which is commonly used to clear specific Windows Event logs such as Security, System, Application, or Setup. This behavior is frequently associated with attackers attempting to remove forensic artifacts and log entries after unauthorized activity.
Detects the clearing of Windows event logs using the native 'wevtutil.exe' utility. This behavior is a common indicator of anti-forensics activity where attackers attempt to remove evidence of their presence or actions on a compromised host.
Detects attempts to clear Windows Event Logs using either the built-in 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' cmdlet. Attackers often clear these logs to remove evidence of intrusion activities, such as persistence mechanisms, account creation, or privilege escalation.
This rule detects suspicious activities involving the Microsoft Edge browser (msedge.exe). It monitors for the spawning of known command-line utilities (e.g., cmd.exe, powershell.exe) by the browser process and the loading of DLLs that do not originate from expected Windows or Microsoft Edge installation directories. Additionally, it correlates these events with recent Microsoft Edge application crashes on the same host, which may indicate exploitation attempts.
Detects instances where a process named 'install.exe' loads a DLL named 'install.res.1033.dll' from the same directory. This pattern is often associated with software installers or potential masquerading attempts where malicious payloads utilize specific resource DLL naming conventions.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' command. This behavior is often associated with adversaries attempting to remove evidence of their actions from a compromised system.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or the PowerShell 'Clear-EventLog' command. This behavior is often associated with adversaries attempting to remove evidence of their actions from a compromised system.
Detects modifications to Windows Registry keys associated with Event Tracing for Windows (ETW) Autologger configurations or Event Log service configurations. These modifications can be used by adversaries to disable or tamper with event logging mechanisms, effectively blinding security telemetry and evading detection.
This rule detects potentially malicious activity within Oracle database audit and alert logs, specifically monitoring for the usage of packages like DBMS_SCHEDULER or UTL_FILE to execute OS commands or manipulate files. It also flags the execution of known exploit scripts or reconnaissance queries commonly associated with database-based attacks and unauthorized data dumping.
Detects attempts to clear Windows event logs using the built-in 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog'. Adversaries often perform this action to remove evidence of malicious activity from the host.
Detects attempts to stop or clear Windows Event Logs using command-line utilities such as 'sc', 'net', or 'wevtutil'. This activity is often performed by adversaries to remove forensic evidence of their actions.
Page 6 of 18