Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
988 detections
Filters
Last updated
All Time
Detection languages
477
129
119
73
69
Contributors
362
161
155
68
43
Categories
20,456
11,839
5,876
5,155
4,865
988
Platforms
568
341
38
36
22
Products / Services
234
206
170
158
109
MITRE Techniques
560
464
381
238
192
CVEs
23
23
15
13
12
IDS Classtypes
1
IDS Protocols
1
Detects the AnyDesk service-side printer worker process spawning suspicious child processes (e.g., cmd.exe, powershell.exe). This activity is indicative of exploitation attempts against CVE-2026-43503, where an attacker leverages the 'adprinterpipe' named pipe to send malicious COM marshaling bytes and impersonate the LocalSystem identity to escalate privileges.
Detects the drop or installation of known vulnerable drivers associated with the 'The Gentlemen' ransomware group's Bring Your Own Vulnerable Driver (BYOVD) tactics, or the creation of kernel-mode services by unsigned binaries. These techniques are often used to gain kernel-level privileges and disable security software.
Detects instances where a non-root user executes the 'sudo' command in combination with 'tee'. This pattern is frequently used to bypass file permission restrictions by appending or writing content to sensitive system files that would normally require root privileges, a common method for privilege escalation or maintaining persistence.
Detects potential privilege escalation and unauthorized file modification by the 'egnyteservice' account. The rule monitors Syslog for sudo usage involving the 'tee' utility with 'NOPASSWD' configuration, or suspicious writes to critical system directories such as /usr/sbin/ and /etc/cron.d/, which are indicative of VerdantBamboo threat actor activity on edge appliances.
This rule detects multi-stage behavior associated with the BQTLock ransomware, including C2 network communication, execution of loaders (PyInstaller-based) from common writable directories, suspicious child process spawning, unauthorized OpenSSH service usage potentially indicating privilege escalation, and mass file encryption indicated by both specific file extensions and bulk rename heuristics.
Detects the UAC bypass technique employed by the BQTLock ransomware, where the registry key 'HKCU\Software\Classes\mscfile\shell\open\command' is hijacked to execute arbitrary binaries such as BQT.exe or malicious scripts via eventvwr.exe, effectively elevating privileges.
Detects common Windows User Account Control (UAC) bypass techniques involving the execution of auto-elevating binaries, the use of PowerShell to launch processes with explicit 'RunAs' verbs, and unauthorized modifications to registry keys within HKCU\Software\Classes.
Detects process-related activities involving specific 'XGU::Feature' command line arguments, commonly associated with token manipulation, credential theft, or lateral movement attempts. This rule monitors process creation, cross-process access, and module loading to identify potentially malicious interactions with Windows security tokens.
This rule detects repeated attempts to use privileges for access checks (EventID 4673) by a single user within a one-hour window, excluding the 'SeTrustedCredentialManagerAccessPrivilege'. A high count of such events (5 or more) could indicate an attempt at privilege escalation or unusual system access behavior.
Detects indicators of the SystemInformer PHSVC (Process Hacker Service) local privilege escalation proof-of-concept. The rule monitors for the loading of the PoC DLL by rundll32, the execution of commands containing specific PoC strings, and the spawning of shell processes by PHSVC-related parent processes.
This rule detects activities associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the loading of known vulnerable drivers, the installation or configuration of drivers via system services, and the execution of tools known to facilitate driver-based kernel manipulation.
Detects the execution of interactive shell or scripting processes (e.g., cmd.exe, powershell.exe, wscript.exe) directly or indirectly spawned by the Microsoft Defender service (MsMpEng.exe). The rule identifies processes running at SYSTEM integrity in an interactive user session, which is indicative of a TOCTOU exploit against the Defender quarantine pipeline.
This rule detects token manipulation and impersonation behaviors characteristic of Cobalt Strike post-exploitation activity. It specifically identifies instances where common child processes (cmd.exe, powershell.exe, net.exe, whoami.exe) are spawned from non-standard parent processes associated with Cobalt Strike payloads (e.g., rundll32.exe, msiexec.exe, svchost.exe), often accompanied by a discrepancy between the effective username and the parent process username or the use of discovery tools post-impersonation.
Detects the execution of SharpGPOAbuse for malicious Group Policy Object (GPO) manipulation, specifically identifying characteristic command-line arguments used for task creation and modification. The rule also monitors for subsequent forced GPO updates via net.exe or net1.exe, often associated with post-exploitation activities in the StrikeShark campaign.
This rule detects the 'Bring Your Own Vulnerable Driver' (BYOVD) technique by monitoring for the creation of new kernel-mode drivers in temporary locations (followed by an immediate registration as a service) that correlate with known vulnerable drivers. It checks file system events for driver drops and links them to service installation events (EventCode 7045) within a 5-minute window.
Detects the AnyDesk.exe process loading a DLL from non-standard, user-writable directories (e.g., AppData, Temp, Downloads). This behavior is indicative of a Component Object Model (COM) hijacking attack where an attacker registers a malicious COM server to trick AnyDesk's printer component into loading an arbitrary DLL, potentially enabling privilege escalation or persistent code execution.
Detects accounts performing multiple sensitive operations, privilege assignments, or privileged service calls in a short timeframe, which may indicate account compromise, reconnaissance, or lateral movement.
Detects reconnaissance and exploit activity associated with the BUMSRAKETE exploit (CVE-2026-45257) targeting FreeBSD. The rule identifies system configuration checks of kernel parameters related to kTLS and mbuf external pages, as well as the execution of file permission manipulation commands often required to bypass immutable (schg) file flags during the exploitation process.
Detects indicators of the BUMSRAKETE FreeBSD kernel-level exploit (CVE-2026-45257). This rule monitors for exploit artifact file creation, malicious use of dd to overwrite SUID binaries for privilege escalation, kernel configuration enumeration via sysctl, spawning of shell processes with root UID from suid-related binaries, and kernel version fingerprinting.
Detects evidence of exploitation for CVE-2026-45257, a FreeBSD vulnerability that allows bypassing chflags schg immutable flags. The detection tracks the initial reconnaissance phase where unprivileged processes query the sysctl 'kern.ipc.mb_use_ext_pgs' followed by the creation of specific exploit restorer artifacts '/tmp/.lpe_orig' and '/tmp/.x'.
Detects OneDrive synchronization service processes or associated modules invoking suspicious token manipulation or privilege enumeration APIs, such as 'StealToken', 'Impersonate_ThisThread', or 'GetPrivileges'. This behavior is indicative of potential privilege escalation or process injection techniques disguised within legitimate cloud sync service processes.
Page 24 of 48