Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,831 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
9,731
2,539
1,169
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,774
3,899
2,669
2,013
1,826
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects various activities associated with the 'Operation Wocao' campaign, including the use of 'checkadmin.exe', 'netsh' commands to modify firewall rules, PowerShell execution with bypass and encoded commands, scheduled task creation, and attempts to query KeePass configuration files and PuTTY sessions from the registry. These activities indicate potential privilege escalation, persistence, discovery, and defense evasion techniques used by the threat actor.
Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of a vulnerability, such as CVE-2025-31324, allowing arbitrary code execution via webshells. The rule specifically looks for common command-line interpreters and scripting engines being launched from SAP NetWeaver's application directories.
This rule detects the execution of various hack tools and scripts commonly used for SMB relay attacks and privilege escalation on Windows systems. It specifically looks for process creations or command-line arguments associated with tools like PetitPotam, RottenPotato, HotPotato, JuicyPotato, Responder, ntlmrelayx, and smbrelayx, as well as PowerShell scripts like Invoke-Tater and Invoke-PetitPotam. The rule aims to identify attempts to exploit NTLM relay vulnerabilities to gain elevated privileges or access credentials.
Detects the execution of various compiled Windows binaries from the Impacket toolset. This rule identifies the tools based on their filenames or partial filenames, which could lead to false positives due to legitimate software having similar names or adversaries renaming the tools. Impacket is a collection of Python classes for working with network protocols, often used by adversaries for lateral movement, credential access, and execution.
Detects remote RPC calls to create or execute a scheduled task via the Advanced Telephony Service (ATSvc) interface. This activity can be indicative of lateral movement, privilege escalation, or persistence mechanisms used by adversaries.
Detects attempts to discover files with setuid/setgid capabilities using the 'getcap' command. This activity is often a precursor to privilege escalation on Linux systems, as adversaries search for binaries that can be abused to gain higher privileges.
This rule detects attempts to add a user to the 'admin' group on macOS systems using the `dscl` command-line utility. Specifically, it looks for `dscl` commands that include the `-append` option, target the `/Groups/admin` path, and modify `GroupMembership`. This activity is often associated with privilege escalation or persistence by granting administrative rights to a standard user account.
This rule detects suspicious DCE-RPC function calls that indicate remote execution techniques on a Windows system. It specifically looks for operations related to scheduled tasks (JobAdd, SchRpcEnableTask, SchRpcRegisterTask, SchRpcRun), WMI execution (ExecMethod, ExecMethodAsync), and service creation/start (CreateServiceA/W, StartServiceA/W). These activities are commonly abused by adversaries for initial access, persistence, and lateral movement.
This rule detects the execution of the 'esxcli' command on an ESXi host with specific arguments to assign administrative permissions to an account. The command line must contain 'system', 'permission', 'set', and 'Admin', indicating an attempt to modify user permissions to grant administrative privileges. This activity is highly suspicious as it can lead to privilege escalation or persistence on the hypervisor.
Detects attempts to exploit the sudo vulnerability CVE-2019-14287, which allows a user to run commands as root by specifying a user ID of -1 or 4294967295 (NO_UID_T) with the '-u' option, bypassing the sudoers policy.
Detects the use of the `mknod` syscall to create special files (e.g., character or block devices) on Linux systems. This syscall is rarely used by legitimate applications and can be abused by attackers or malware to create fake devices, interact with kernel interfaces, establish covert channels, bypass file system restrictions, or create backdoors.
This rule detects the installation of a new service that exhibits characteristics commonly associated with the Meterpreter or Cobalt Strike 'getsystem' command. Specifically, it looks for Event ID 4697 (A service was installed in the system) and then analyzes the 'ServiceFileName' for patterns indicative of these tools. It identifies two main techniques: one involving 'cmd.exe' or '%COMSPEC%' echoing data to a named pipe (e.g., `echo 559891bb017 > \\.\pipe\5e120a`), and another involving 'rundll32.exe' loading a DLL with specific arguments (e.g., `rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn`). Additionally, it flags service installations where the 'ServiceFileName' starts with a specific network share path (`\\127.0.0.1\ADMIN$\`). These methods are typically used by adversaries to escalate privileges to SYSTEM.
This rule detects instances where 'powershell.exe', 'pwsh.exe', or 'conhost.exe' are launched by 'explorer.exe' with a command line containing an unusual number of spaces or tabs. This pattern can indicate obfuscation attempts often used by adversaries to hide malicious commands or scripts.
Detects various suspicious activities associated with the HAFNIUM threat group targeting Microsoft Exchange servers. This includes attempts to hide files using `attrib`, scheduled task creation for persistence, execution of an unusual Opera browser, shadow copy enumeration, and data staging/exfiltration using `makecab`, `7zip`, and `rundll32` for minidump creation.
Detects the execution of concatenated commands via "cmd.exe" that are characteristic of Pikabot malware. Pikabot often uses "cmd /c" to combine commands like "curl" or "wget" for downloading payloads, "ping" and "timeout" for delays, and "Rundll32" for executing malicious DLLs. The rule specifically looks for the combination of these commands, indicating potential Pikabot infection.
This rule detects the usage of the 'Get-ReverseShell' PowerShell tool by looking for specific strings associated with its code and its GitHub repository. The rule specifically targets the string "odTPYnuuGIGzrAeHM ", the obfuscation string "Invoke-PSObfuscation", and the GitHub repository URL "https://github.com/gh0x0st". This tool is designed to create reverse shells, which are commonly used by attackers for remote access and control.
Detects post-exploitation execution technique of the Serpent backdoor. This involves creating a temporary scheduled task using an unusual method: creating a fictitious Windows event and a trigger that executes a payload once the event is created. The detection specifically looks for command-line arguments indicative of this behavior when executed by cmd.exe or powershell.exe.
Detects the execution of the 'doas' utility on Linux systems. 'doas' allows standard users to execute commands as another user, typically root, similar to 'sudo'. This can be used by adversaries for privilege escalation or defense evasion.
This rule detects modifications to Cisco device configurations that could be used by an adversary for persistence, privilege escalation, or to impact system availability. Specifically, it looks for commands related to enabling HTTP/HTTPS servers, configuring Kron jobs (scheduled tasks), modifying access lists, archiving configurations, and setting NTP servers. These commands, if used maliciously, can allow an attacker to maintain access, execute arbitrary commands, control network access, or disrupt time synchronization.
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
This rule detects LNK (shortcut) files that contain embedded PowerShell commands, specifically looking for the string "powershell" and the argument "-windowstyle hidden". This combination is often used by adversaries to execute malicious PowerShell scripts discreetly, making them less visible to the user.
Page 468 of 564