Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
747 detections
Filters
Last updated
All Time
Detection languages
369
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
300
145
136
94
Platforms
650
48
24
21
15
Products / Services
192
177
145
133
132
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
747
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
This rule detects changes to VPC Network Peering configurations in Google Cloud Platform (GCP). VPC peering allows internal IP address connectivity across different VPC networks. Unauthorized modifications, such as adding or updating peering connections, could indicate an adversary attempting to establish lateral movement paths between network environments, facilitate data exfiltration, or modify network architecture to bypass security perimeters.
This rule detects modifications to Google Cloud Platform (GCP) Cloud DNS managed zones, including creating, deleting, patching, updating, or changing records within a managed zone. It performs triage by categorizing the actor as either a human or a service account, checks for the use of Infrastructure-as-Code (Terraform), and flags potentially anomalous activity such as service accounts interacting with DNS outside of expected networks or without using automated tooling.
This rule detects potential adversary activity aimed at disabling security tools, critical infrastructure services, or cloud synchronization agents. It monitors for a high volume (6 or more) of process termination commands (e.g., taskkill, net stop) or registry-based service disabling (Start value 4) targeting a predefined list of security and critical system services within a 3-minute window, which is indicative of an attempt to blind security monitoring or disrupt system availability.
Detects operations that remove, disable, delete, or update billing limits, spending limits, usage alerts, spend notifications, billing thresholds, or cost alerts on AI service accounts, which may indicate an attacker attempting to remove financial guardrails to enable unrestricted abuse of stolen AI API credentials.
Detects a sequence of potentially malicious activities on a Windows host: a batch script command referencing AMSI bypass, followed within 30 minutes by a registry modification affecting Windows SmartScreen settings, and culminating in a silent MSI installation (msiexec.exe /qn). This pattern is consistent with an adversary attempting to disable security controls to facilitate an stealthy software installation.
Detects driver-level WFP filter/callout registration at network-redirection-relevant layers that can be used to redirect or interfere with security-vendor network traffic (G12 capability).
Detects G12clean.exe creating a kernel driver file (drv.sys or anticheatG13.sys) while its own command line references the XOR key 0xAB, consistent with decoding and dropping an obfuscated driver payload.
Detects the use of PowerShell cmdlets 'Set-MpPreference' to disable real-time monitoring or 'Add-MpPreference' to add exclusion paths. The rule specifically alerts on these actions when accompanied by obfuscation or hidden execution flags, identifying behavior common to defense evasion tactics used by malware like the Larva-24009 backdoor. Legitimate management tools (e.g., SCCM, Intune) are excluded.
Detects a full defense-evasion sequence against the drvsvc kernel service and its drv.sys driver: stop, poll, delete, and re-drop occurring within a short time window.
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Detects a cross-process kernel memory write primitive invoked via IOCTL control code 0x22209C, where the initiating process is unsigned and the write targets a process other than itself.
Detects multiple G13-related artifacts (anticheatG13.sys, drv.sys, WindowsData*.log) dropped into Windows Temp or drivers directories within a 15-minute window by the same unsigned initiating process.
This rule detects the execution of processes associated with G12/G13 EDR-killer tools. These tools are specifically designed to automate the termination of security software, antivirus solutions, and remote management processes, which is a common tactic used by adversaries to evade detection and maintain persistence.
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
Detects reconnaissance of system security posture by unsigned or unknown processes. The rule monitors for a combination of AV/EDR product enumeration (SecurityCenter2, Windows Defender exclusion queries), RDP history collection, Office MRU collection, and general system information gathering. It correlates two or more of these activities originating from the same process within a 15-minute window, while excluding known legitimate security and management software.
Detects HollowMare variants (OneZip/CrystalPDF/PowerDoc) that terminate a running Chrome or Firefox process immediately before overwriting a browser profile configuration file (Preferences, Secure Preferences, prefs.js) with a C2-supplied version to hijack the default search engine.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
Page 27 of 36