Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,587 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
This rule detects suspicious Okta login attempts where a user successfully passes the initial authentication factor but then fails or abandons a subsequent Multi-Factor Authentication (MFA) challenge, originating from a new IP address, device (user agent), and city combination. It filters out events from known corporate VPN IP addresses to reduce false positives.
Detects Component Object Model (COM) hijacking used by the Curly COMrades threat actor for persistence. This rule identifies registry modifications that alter specific CLSIDs related to the .NET NGEN task to load the MucorAgent malware.
The analytic detects the installation of a Linux kernel module using the `modprobe` utility. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
Detects potential DLL Sideloading activity as used by LockBit ransomware operators. This rule identifies when a legitimate, signed application (e.g., MpCmdRun.exe, jarsigner.exe) loads a corresponding DLL from the same, non-standard directory, a common TTP for defense evasion.
The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
Detects suspicious activities in Salesforce environments consistent with the TTPs of the ShinyHunters threat group (also tracked as UNC6040/UNC6240). The attack involves social engineering (vishing) to trick users into authorizing malicious OAuth applications that impersonate legitimate tools like 'Salesforce Data Loader'. This rule looks for key indicators such as the installation of unreviewed packages, creation of impersonating connected apps, elevation of permissions to 'full' API access, and large data exports.
Detects instances where NodeJS (node.exe) spawns the Command Processor (cmd.exe) to execute the 'reg add' command. This behavior is a known persistence technique used by the NodeInitRAT backdoor, associated with the Mocha Manakin threat actor, to add a run key to the Windows Registry.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects when a Group Policy Object (GPO) is modified to include Client-Side Extensions (CSEs) for managing local group memberships or user rights assignments. While this can be a legitimate administrative action, attackers can abuse this capability to escalate privileges by adding accounts to sensitive local groups (e.g., Administrators) or granting powerful user rights. This alert serves as an early warning to investigate the specific changes made within the GPO.
Detects potential exploitation of FortiWeb CVE-2025-25257, a pre-authentication SQL injection vulnerability. This rule identifies an SQL injection attempt against the '/api/fabric/device/status' endpoint, followed by either a suspicious Python file drop in a library directory or a request to a specific CGI script used to trigger the payload.
This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Detects the NodeInitRAT NodeJS backdoor script used by the Mocha Manakin threat actor. This rule identifies specific strings related to C2 communication, persistence mechanisms, and command execution found within the script.
Detects the creation of specific ASPX web shells in the SharePoint LAYOUTS directory, a TTP associated with the exploitation of the 'ToolShell' vulnerabilities (e.g., CVE-2025-49706, CVE-2025-53770).
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
This detects looks for the creation of scheduled tasks where the task content explicitly references a temporary file within the user's AppData\Local\Temp directory. This activity has been observed by AgentTesla as persistence mechanisms attempting to execute from a temporary location.
Detects the keylogger component (WinMainSvc.dll) used by the Crypto24 ransomware group for persistence via Windows Services.
This rule detects attempts to disable Multi-Factor Authentication (MFA) within Microsoft 365 services. Specifically, it looks for audit log entries containing the operation 'Disable Strong Authentication.' This action could be performed by an attacker to maintain persistent access to compromised accounts by removing an important security layer.
Detects the installation of a Windows service associated with an AV/EDR killer tool. The tool uses a driver signed with a known malicious, revoked, or expired certificate to disable security products. This activity has been associated with multiple ransomware families, including RansomHub, Blacksuit, and Medusa.
Detects when an application or service principal performs sensitive configuration changes, likely via the Microsoft Graph API. This can indicate an attacker using a compromised or malicious application for persistence (adding credentials), privilege escalation (adding owners), or defense evasion (modifying Conditional Access policies). This aligns with the "Consent & Compromise" research where attackers abuse application permissions.
Page 459 of 600