Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects COR_PROFILER environment variable abuse for .NET DLL hijacking
Detects unauthorized access to Windows Credential Manager vault
Detects attempts to dump LSASS memory for credential extraction
Detects abuse of trusted MSP remote management tools for initial access
Detects modification of macOS re-opened applications list for persistence on login
Detects KernelCallbackTable manipulation for process injection via kernel callback
Detects reflective DLL loading technique that avoids writing files to disk
Detects LD_PRELOAD environment variable set to load malicious shared libraries
Detects in-memory archive creation using .NET compression libraries
Detects malware checking for user activity to detect sandbox environments
Detects processes ignoring termination signals to prevent shutdown
Detects ListPlanting injection using LVM_SORTITEMS and SendMessage API
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
Detects installation of malicious Exchange transport agents for email persistence
Detects SSH agent forwarding being abused for lateral movement
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Attempts to discover running processes on a Windows system using either native utilities or PowerShell commands/API calls. Adversaries often use these methods to gain information about running processes as part of discovery.
Hunting rule, not a drop in detection
Hunting rule, not a drop in detection
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Detects the execution of Windows 365 native clients (Windows365.exe). Threat actors like UNC3753 abuse legitimate VDI clients on compromised BYOD devices to bypass corporate perimeters and access sensitive internal network segments.
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
Page 67 of 84