Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,542 detections
Filters
Last updated
All Time
Detection languages
2,477
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,453
11,837
5,876
5,154
4,865
4,542
Platforms
3,840
1,049
473
39
29
Products / Services
1,834
1,138
211
183
171
MITRE Techniques
1,604
1,422
1,300
748
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects scripts (Batch, PowerShell) that create a hidden local account (appended with $) and add it to highly privileged groups like Administrators and Remote Desktop Users.
Detects the creation of 'format-results.txt' on a system, which is used by the malicious GitHub Actions workflow injected by the Checkmarx worm to store serialized GitHub repository secrets.
Detects the creation of symbolic links targeting the Restricted kernel object namespace, which the BlueHammer exploit uses for path confusion during a TOCTOU race condition to achieve Local Privilege Escalation.
This rule detects the execution or writing of a file with a specific SHA256 hash associated with the 'GateKeeper' payload. It monitors process creation events, new executable writes, PE file writes, and image loads on Windows platforms to identify the presence and activity of this known malicious file.
Detects the creation or modification of a .pth file named LiteLLM_init.pth in Python site-packages directories. This provides high-fidelity identification of the Python interpreter startup persistence mechanism used by TeamPCP in the LiteLLM supply chain compromise.
https://github.com/Nightmare-Eclipse/UnDefend
https://github.com/Nightmare-Eclipse/RedSun/blob/main/README.md
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.
This rule detects file creation, modification, or renaming events related to 'TieringEngineService.exe' in the 'C:\Windows\system32\' directory, or process execution of 'TieringEngineService.exe' running as the 'SYSTEM' account. This activity could indicate suspicious system-level operations or potential abuse of a legitimate Windows component.
Detects non-Defender processes accessing the Windows Defender signature definition file (mpasbase.vdm). This file should exclusively be accessed by Defender platform processes (MsMpEng.exe, MpCmdRun.exe, NisSrv.exe, etc.) and Windows servicing components. Any other process touching this file has zero legitimate use cases and is a high-fidelity indicator of the BlueHammer zero-day LPE exploit, which leverages a batch oplock on mpasbase.vdm to freeze Defender mid-read, then performs NTFS junction swapping to redirect SYSTEM-context reads to the SAM hive via a VSS snapshot, resulting in local credential theft and privilege escalation. MITRE: T1068 - Exploitation for Privilege Escalation. References: https://github.com/Nightmare-Eclipse/BlueHammer, https://www.deobfuscated.dev/posts/defender-lpe-0-day
Detects the creation of the specific LaunchAgent plist file ('com.vfrfeufhtjpwgray.plist') used by the macOS AppleScript dropper in the REF6598 campaign for persistence, ensuring visibility into the non-Windows infection chain.
KQL Query from file: DefenderXDR BlueHammer Detection
Identifies the creation of a specific LaunchAgent plist file associated with the PhantomPulse macOS AppleScript dropper, indicating persistence on macOS systems.
Detects the creation of a shortcut (.lnk) file in the Windows Startup folder containing 'Edge' or 'msedge' in its name. This matches the persistence mechanism used by LucidRook and its droppers (like LucidPawn) which drop a disguised Microsoft Edge shortcut to execute a renamed DISM binary.
Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character
Detect changes in auditd configuration files
Detects the ld.so preload persistence file. See `man ld.so` for more information.
Based off of BlueHammer Local Priv Escalation, exploiting Windows Defender's signature file handling
Detects the creation of a DLL named DismCore.dll within the ProgramData or AppData\Local\Microsoft\WindowsApps directories. This behavior is indicative of potential LucidPawn/LucidRook DLL sideloading preparation where it attempts to hijack the search order of legitimate DISM binaries.
This rule detects the creation of directories or files related to the malicious 'plain-crypto-js' package within 'node_modules' folders. This activity is associated with the WAVESHAPER.V2 RAT, which targets developer and CI/CD systems through supply chain compromise of npm packages like Axios.
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory.
Page 180 of 217