Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,294 detections
Filters
Last updated
All Time
Detection languages
1,284
250
199
142
138
Contributors
660
544
375
96
95
Categories
20,456
11,839
5,877
5,156
4,865
2,294
Platforms
1,505
929
381
70
51
Products / Services
743
407
225
164
140
MITRE Techniques
856
683
604
437
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects a suspicious sequence of activities that potentially indicates an attempt to exploit Common Log File System (CLFS) vulnerabilities or manipulate cloud filter drivers for privilege escalation. The rule monitors for a correlation between Registry modifications involving Cloud Filter settings (HKLM\SYSTEM\CurrentControlSet\Services\CldFlt) and the creation or modification of specific CLFS-related files (.blf, .blf2, .regtrans-ms) occurring within a 10-minute window, with an optional check for symbolic link manipulation (NtCreateSymbolicLinkObject).
Detects creation of a mandatory profile hive (NTUSER.MAN) matching the size produced by the RegLoadAppKeyW -> ORCreateKey/ORSetValue/ORSaveHive offreg.dll API sequence used to forge an offline registry hive for persistence, as observed with the TWINLOOT Python implant. TWINLOOT builds the offline hive via offreg.dll (RegLoadAppKeyW, ORCreateKey, ORSetValue, ORSaveHive) with Run key or COM hijack values baked in, then writes it to %USERPROFILE%\NTUSER.MAN so Windows loads it in preference to NTUSER.DAT at the next user logon, achieving persistence with no registry events, no admin privileges, and no visibility to standard tooling. Tightened to exclude the process image when it is a known legitimate profile-management or provisioning tool (USMT, SCCM, Intune Management Extension) that also uses offreg.dll to build NTUSER.MAN during normal mandatory/roaming profile deployment.
Detects creation of new scheduled tasks (cron), systemd services, or startup entries that reference the reverse_ssh tool, consistent with attacker persistence established after vCenter compromise.
This rule detects the creation or modification of suspicious files (extensions associated with web shells or modules, such as .aspx, .ashx, .asmx, .dll, or .config) within common Microsoft IIS and Exchange web directories. It correlates these file events with process activity initiated by common web server or management processes (e.g., w3wp.exe, powershell.exe) and filters out trusted files (Microsoft-signed), known administrative update activity, and files with a broader footprint in the environment to identify potentially malicious, low-prevalence artifacts.
Detects the execution of native binaries, the creation/modification of Node-API (.node) files, or the loading of .node modules from Visual Studio Code extensions directories. This behavior is indicative of malicious VS Code extensions attempting to execute arbitrary native code for reconnaissance, persistence, or exfiltration.
Detects MsMpEng.exe creating a file in C:\\Windows\\System32\\.
This should never happen under normal operation Windows Defender does not install kernel drivers at runtime.
In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.
This should never happen under normal operation Windows Defender does not install kernel drivers at runtime.
In the BlueHammer exploit, the TOCTOU race causes MsMpEng (SYSTEM) to write the attacker's driver payload directly into the drivers directory.
This rule monitors for suspicious activity involving the OneDrive directory, specifically the file 'wtsapi32.dll'. It triggers when this DLL file is created, modified, or renamed within the OneDrive folder, followed by the termination of the OneDrive process, and subsequent loading of the same DLL file by that process. This pattern is indicative of a DLL side-loading attack where a legitimate application (OneDrive) is used to load a malicious DLL.
Detects potential exploitation of the ScreenConnect SetupWizard.aspx to bypass authentication and create unauthorized administrative users. The rule monitors for the creation or modification of User.xml or Users.xml files in the ScreenConnect application directories, correlating these file events with suspicious process activity (such as cmd.exe or powershell.exe) or web requests to the SetupWizard.aspx endpoint.
The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries.
Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash.
In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity.
If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
This rule detects a suspicious sequence of activities that potentially indicates an attempt to exploit Common Log File System (CLFS) vulnerabilities or manipulate cloud filter drivers for privilege escalation. The rule monitors for a correlation between Registry modifications involving Cloud Filter settings (HKLM\SYSTEM\CurrentControlSet\Services\CldFlt) and the creation or modification of specific CLFS-related files (.blf, .blf2, .regtrans-ms) occurring within a 10-minute window, with an optional check for symbolic link manipulation (NtCreateSymbolicLinkObject).
Detects modifications to the Transparency, Consent, and Control (TCC) database on macOS. The rule categorizes activity based on the file path (system-wide or user-specific) and the user account performing the modification, identifying potentially unauthorized changes to application privacy permissions.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
This rule detects potential data exfiltration or verification behavior by correlating a file write event in a temporary directory (/tmp/) with a subsequent 'cat' command execution reading that same file within a 10-minute window. This behavioral pattern is often associated with C2 agents staging data for retrieval.
Detects a non-system process causing creation of CldFlt0.etl under C:\Windows\System32\LogFiles\CloudFiles\.
This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot().
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.
This path is initialised by the CldFlt driver when a process calls CfRegisterSyncRoot() or CfConnectSyncRoot().
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
Legitimate cloud providers (OneDrive etc.) register sync roots from SYSTEM-level service processes, not from user-context executables.
Detects file creation, write, or rename operations to specific paths known to be used in exploitation of CVE-2026-63077.
This rule monitors for two critical firmware-related conditions: detected non-compliance with secure boot, UEFI, or TPM configuration standards via Microsoft Defender TVM, and explicit firmware or boot configuration change events reported by device telemetry. It is designed to identify potential tampering or misconfigurations that could facilitate bootkits or other pre-OS persistence mechanisms.
This rule monitors for two critical firmware-related conditions: detected non-compliance with secure boot, UEFI, or TPM configuration standards via Microsoft Defender TVM, and explicit firmware or boot configuration change events reported by device telemetry. It is designed to identify potential tampering or misconfigurations that could facilitate bootkits or other pre-OS persistence mechanisms.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
This rule detects potential attempts to bypass macOS Gatekeeper security checks by identifying the removal of the 'com.apple.quarantine' extended attribute using the 'xattr' utility, or by changing file permissions using 'chmod' on files marked with the 'com.apple.verified' attribute. Adversaries use these techniques to ensure malicious or untrusted binaries execute without user prompts or security warnings.
Detects modification of sensitive Active Directory LDAP attributes (msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, scriptPath, msTSInitialProgram, msDS-KeyCredentialLink) via Windows Security EventCode 5136, and correlates the initiating session back to its originating logon (EventCode 4624) to surface the actor's SID, domain, source IP, and logon host. These attributes are commonly abused for Kerberos delegation abuse (constrained/resource-based constrained delegation), logon-script/Terminal-Services persistence, and Shadow Credentials (msDS-KeyCredentialLink) attacks. Includes anchor fields (initiator SID, domain controller, distinct-attribute count, operation correlation ID) to support precise, low-blast-radius tuning instead of broad exclusions.
This rule detects the creation or modification of files within the Google Chrome browser extensions directory by processes other than legitimate Chrome-related binaries (chrome.exe, GoogleUpdate.exe). This activity is highly indicative of malicious browser extension sideloading or persistence, where an adversary attempts to install a rogue extension to achieve goals such as credential theft, session hijacking, or command-and-control communication.
Page 48 of 110