Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
Detects the loading of the Alinubx.sys kernel driver or the creation of an NvFsFilter service, which are associated with a BYOVD (Bring Your Own Vulnerable Driver) attack leveraging a renamed CcProtect driver to bypass security protections such as PPL.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
Detects attempts to clear Windows event logs using built-in utilities such as wevtutil.exe or PowerShell cmdlets (Clear-EventLog, Clear-WinEvent). Adversaries often perform this action to remove traces of malicious activity from the system.
Detects the use of the 'wevtutil.exe' utility to clear Windows Event Logs. This is a common technique used by adversaries to disrupt logging and evade detection of their actions on a host. The rule specifically monitors for the 'cl' (clear-log) command applied to sensitive operational channels, triggering when multiple clearing operations are detected within a 5-minute window.
Detects attempts to clear Windows event logs using administrative tools like wevtutil.exe, PowerShell, or through the detection of mass log-clear audit events (such as Event IDs 1102 and 104) occurring in a rapid burst. This activity is often used by adversaries to hide evidence of post-compromise actions.
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
Detects pre-encryption defensive measures employed by the Monkey ransomware C++ variant. This rule triggers on behaviors including Microsoft Defender exclusion management, disabling of AMSI or ETW components, manipulation of system security settings via registry, and attempts to clear PowerShell or command-line history to facilitate anti-forensic evasion.
This rule identifies potential persistence activity on a Windows host by correlating multiple indicators such as service creation, scheduled tasks, registry run key modifications, Winlogon helper modifications, and driver loading. It specifically monitors for indicators associated with 'NetSupport' or 'client32' filenames or services. The rule triggers when two or more distinct persistence mechanisms are detected for the same host and user.
Detects the abuse of the legitimate Windows script 'SyncAppvPublishingServer.vbs' to proxy the execution of malicious commands, specifically by appending an arbitrary command separated by a semicolon.
Detects the installation of a GitLab Runner service on Windows, specifically identifying cases where the service is configured to run under the LocalSystem account. This is monitored via Service Control Manager (Event ID 7045), Sysmon (Registry Event ID 13), and process creation events involving sc.exe or gitlab-runner.exe.
Detects DragonForce ransomware behavior where the binary is copied to a staging directory (typically C:\Users\Public\) and subsequently registered as a persistent, one-time execution scheduled task with SYSTEM privileges using COM interfaces or schtasks.exe.
Detects the use of bcdedit.exe to modify the boot configuration to enable Safe Mode with Networking. This is often used by adversaries to bypass security controls or to prepare a system for activities while in a state where many security products may not load or function.
This rule detects the use of 'taskkill.exe' to terminate critical services, including security software (MsMpEng.exe), database processes (sql.exe, oracle.exe, sqlservr.exe), and common user applications (outlook.exe, onedrive.exe). This behavior is characteristic of the DragonForce ransomware, which disables protective services and applications before encryption to minimize interference and ensure successful file locking.
Detects the modification of boot configuration data (BCD) using bcdedit to enable 'Safe Mode with Networking' on the next reboot. Adversaries, including Akira ransomware affiliates, use this technique to bypass endpoint detection and response (EDR) solutions by ensuring they do not start when the system boots in a restricted safe mode.
This rule detects the installation of a new Windows service (Event ID 7045 or 4697) with an 'auto start' configuration that is immediately followed by the termination of multiple processes (either 'services.exe' or the service's own image file) within a 60-minute window on the same host. This pattern can indicate an unstable or malicious service deployment that causes system instability or performs rapid cleanup.
Detects multiple defense evasion techniques typically associated with the Monkey ransomware family, including clearing Windows Event Logs, clearing PowerShell command history, tampering with AMSI and ETW, modifying Microsoft Defender exclusions, and disabling Task Manager or CMD via registry keys.
Detects anomalous post-exploitation behaviors such as mass file modifications, lateral movement (SMB/RDP), or persistence mechanisms (scheduled tasks/services) following ScreenConnect client session activity. This behavior is indicative of potential exploitation of ScreenConnect to deploy ransomware or move laterally within the network.
Detects the creation or modification of a Windows service named 'ProcAuditManager' via registry keys or command-line utilities. This pattern is indicative of potential persistence mechanisms or service manipulation for malicious purposes.
Detects the creation or modification of a Windows service named 'ProcAuditManager' via registry keys or command-line utilities. This pattern is indicative of potential persistence mechanisms or service manipulation for malicious purposes.
Page 8 of 61