Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Get stats on ASR audit events - count events and machines per rule.
This query was originally published in the threat analytics report, CVE-2018-8653 scripting engine vulnerability.
CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine for several releases of Internet Explorer. An attacker exploiting this CVE could use a malicious webpage to gain the same access rights as the currently logged-in user -- which is particularly problematic if the user is an administrator.
Microsoft has since addressed this vulnerability.
The following queries detect possible exploitation of this CVE.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8653
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2018-8653
CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine for several releases of Internet Explorer. An attacker exploiting this CVE could use a malicious webpage to gain the same access rights as the currently logged-in user -- which is particularly problematic if the user is an administrator.
Microsoft has since addressed this vulnerability.
The following queries detect possible exploitation of this CVE.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8653
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2018-8653
The query checks process command lines arguments and parent/child combinations to find machines where there have been.
Attempts to exploit the Protocol Handler Vulnerability of Electron framework CVE-2018-1000006.
Electron is a common framework used by many popular applications (e.g. Skype, Teams, Slack, VSCode) which expose protocol handlers.
Which can trigger a remote code execution vulnerability via a browser vector (e.g. Chrome, Internet Explorer, Edge).
CVE: CVE-2018-1000006.
Read more here:.
Https://electronjs.org/blog/protocol-handler-fix.
Https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000006.
Https://www.exploit-db.com/exploits/43899.
Https://hackernoon.com/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374.
Tags: #exploit #CVE-2018-1000006 #Electron.
Attempts to exploit the Protocol Handler Vulnerability of Electron framework CVE-2018-1000006.
Electron is a common framework used by many popular applications (e.g. Skype, Teams, Slack, VSCode) which expose protocol handlers.
Which can trigger a remote code execution vulnerability via a browser vector (e.g. Chrome, Internet Explorer, Edge).
CVE: CVE-2018-1000006.
Read more here:.
Https://electronjs.org/blog/protocol-handler-fix.
Https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000006.
Https://www.exploit-db.com/exploits/43899.
Https://hackernoon.com/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374.
Tags: #exploit #CVE-2018-1000006 #Electron.
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1069 (also known as BearLPE), the second vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1069 (also known as BearLPE), the second vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by finding suspicious file creation events associated with Nufsys.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by finding suspicious file creation events associated with Nufsys.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by reporting network communication associated with the Nufsys attacks.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by reporting network communication associated with the Nufsys attacks.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild".
In early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:
1. CVE-2021-26855
2. CVE-2021-26857
3. CVE-2021-26858
4. CVE-2021-27065
The following query surfaces when unusual subprocesses were launched by MWorkerProcess, the Exchange Unified Messaging service. This might indicate exploitation of CVE-2021-26857 to run arbitrary code.
More queries related to this threat can be found under the See also section of this page.
Reference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
In early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:
1. CVE-2021-26855
2. CVE-2021-26857
3. CVE-2021-26858
4. CVE-2021-27065
The following query surfaces when unusual subprocesses were launched by MWorkerProcess, the Exchange Unified Messaging service. This might indicate exploitation of CVE-2021-26857 to run arbitrary code.
More queries related to this threat can be found under the See also section of this page.
Reference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1129 (also known as ByeBear or CVE-2019-0841-Bypass 2), the sixth vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-1129 (also known as ByeBear or CVE-2019-0841-Bypass 2), the sixth vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by reporting scheduled task creation events associated with the Nufsys attacks.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by reporting scheduled task creation events associated with the Nufsys attacks.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
This query was originally published in the threat analytics report, May 2019 0-day disclosures.
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-0863 (also known as AngryPolarBearBug2), the first vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
In May and June of 2019, a security researcher with the online alias, SandboxEscaper, discovered and published several elevation-of-privilege vulnerabilities on Github. The researcher included proofs-of-concept demonstrating how to exploit these vulnerabilities.
Patches and more information about each vulnerability are available below:
1. CVE-2019-0863 | Windows Error Reporting Elevation of Privilege Vulnerability
2. CVE-2019-1069 | Task Scheduler Elevation of Privilege Vulnerability
3. CVE-2019-1053 | Windows Shell Elevation of Privilege Vulnerability
4. CVE-2019-1064 | Windows Elevation of Privilege Vulnerability
5. CVE-2019-0973 | Windows Installer Elevation of Privilege Vulnerability
6. CVE-2019-1129 | Windows Elevation of Privilege Vulnerability
This query locates possible activity that exploits CVE-2019-0863 (also known as AngryPolarBearBug2), the first vulnerability listed above.
Reference - https://threatpost.com/sandboxescaper-more-exploits-ie-zero-day/145010/
Detects potential Java webshell uploads to an SAP NetViewer server via HTTP POST requests with a 'Content-Type' of 'application/octet-stream' and URI stems containing '/irj/' and ending with '.jsp', '.class', or '.java'. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells.
The analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.
Detects potential command execution via webshell in SAP NetViewer through JSP files with 'cmd' or similar parameters. This rule is designed to identify exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell by looking for specific URI patterns and query parameters indicative of command execution attempts, including common Linux commands and base64 encoded commands.
The following analytic detects suspicious modifications to the registry that may indicate a UAC (User Account Control) bypass attempt via the SilentCleanup task. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry changes in the path "*\Environment\windir" with executable values. This activity is significant as it can allow an attacker to gain high-privilege execution without user consent, bypassing UAC protections. If confirmed malicious, this could lead to unauthorized administrative access, enabling further system compromise and persistence.
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could indicate an attempt to exploit CVE-2020-1048, a Windows Print Spooler elevation of privilege vulnerability, by registering a malicious printer port.
The analytic identifies potential exploitation attempts on a PaperCut NG server by analyzing its debug log data. It detects unauthorized or suspicious access attempts from public IP addresses and searches for specific URIs associated with known exploits. The detection leverages regex to parse unstructured log data, focusing on admin login activities. This activity is significant as it can indicate an active exploitation attempt on the server. If confirmed malicious, attackers could gain unauthorized access, potentially leading to data breaches or further compromise of the server.
This rule detects the execution of Mimikatz or Mimikatz-like tools by looking for specific command-line arguments commonly used by the tool. Mimikatz is a well-known post-exploitation tool used to extract plaintext passwords, hash, PIN codes, and Kerberos tickets from memory, particularly from the Local Security Authority Subsystem Service (LSASS) process. The rule identifies various Mimikatz modules and commands such as "dumpcreds", "mimikatz", "::aadcookie", "::detours", "::memssp", "::mflt", "::ncroutemon", "::ngcsign", "::printnightmare", "::skeleton", "::preshutdown", "::mstsc", "::multirdp", "rpc::", "token::", "crypto::", "dpapi::", "sekurlsa::", "kerberos::", "lsadump::", "privilege::", "process::", and "vault::". Detection of these arguments indicates an attempt to perform credential access or privilege escalation.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack. This rule detects the execution of SharpSuccessor.exe or command-line arguments containing 'SharpSuccessor' in process launch events or specific Windows Security Auditing events (EventCode 4673) indicating a privileged service call. This activity is indicative of privilege escalation attempts in Active Directory environments, specifically leveraging 'CreateChild' permissions over Organizational Units (OUs) to escalate privileges to Domain Administrator.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP. This activity can indicate an attacker exploiting a public-facing application to gain initial access and execute arbitrary commands.
Detects corrupted packets sent to the MSMQ service, which could indicate an attempt to exploit CVE-2023-21554, a critical remote code execution vulnerability in Microsoft Message Queuing (MSMQ). The rule specifically looks for EventID 2027 with a Level of 2 (Error) from the 'MSMQ' provider in the Windows Application event log.
This rule identifies process creations or file creations where the associated file has been tagged as an 'exploit' by VirusTotal. It leverages enrichment from a VirusTotal integration to flag potentially malicious activity related to exploit execution.
Page 144 of 159