Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,587 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
This detection identifies the deletion of registry keys under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\, which store records of previously connected remote systems via Remote Desktop Protocol (RDP). These keys are created automatically when a user connects to a remote host using the native Windows RDP client (mstsc.exe) and can be valuable forensic artifacts for tracking remote access activity. Malicious actors aware of this behavior may delete these keys after using RDP to hide evidence of their activity and avoid detection during incident response. This form of artifact cleanup is a known defense evasion technique, often performed during or after lateral movement. Legitimate users rarely delete these keys manually, making such actions highly suspicious—especially when correlated with RDP usage, unusual logon behavior, or other signs of compromise. Detecting the deletion of these registry entries can provide crucial insight into attempts to cover tracks following interactive remote access.
The following analytic detects the creation of suspicious service files within the systemd directories on Linux platforms. It leverages logs containing file name, file path, and process GUID data from endpoints. This activity is significant for a SOC as it may indicate an adversary attempting to establish persistence on a compromised host. If confirmed malicious, this could lead to system compromise or data exfiltration, allowing attackers to maintain control over the system and execute further malicious activities.
Detects potential exploitation of Dell ControlVault vulnerabilities (dubbed 'ReVault') by monitoring for related service crashes or the abnormal loading of the `bcmbipdll.dll` module. An attacker with local access can exploit these vulnerabilities for privilege escalation or persistence.
Detects the usage of PowerDodder, a post-exploitation persistence tool that appends malicious commands to existing script files by hijacking their execution flow.
This query detects multiple behaviors associated with the ApolloShadow malware, used by the Secret Blizzard threat actor. It looks for the creation of a specific administrator account, installation of root certificates using certutil, modification of Firefox settings to trust new certificates, and changes to network profiles to relax firewall rules.
This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.
This rule detects suspicious file access patterns to Chromium-based browser extension data folders. Specifically, it looks for any process other than the browser itself (msedge.exe, chrome.exe, wavebrowser.exe, vivaldi.exe, brave.exe, brchrome.exe) reading or accessing files within the 'AppData\Local\User Data\Default\Extensions' directory. This activity could indicate an attempt by malware or an unauthorised process to inspect, modify, or exfiltrate data related to browser extensions, potentially for credential theft, session hijacking, or to inject malicious code into extensions.
Detects the installation of specific malicious versions of several npm packages. Threat actors gained access to maintainer accounts via a phishing campaign and published compromised versions containing malware. The payloads ranged from a Windows-based information stealer (Scavenger) to a cross-platform JavaScript backdoor.
This analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. The detection specifically looks for modifications to the 'Run' registry keys or 'ImagePath' values within service registry keys, which are common methods for establishing persistence. The rule leverages a lookup table containing known remote access tools such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
Detects suspicious activity related to Storm-2603 ransomware operations, including ToolShell exploitation, DLL sideloading, BYOVD AV-killers, and multi-ransomware deployment (LockBit, Warlock).
The following analytic detects potential RDP Hijacking attempts by identifying the creation of a Windows service using sc.exe with a binary path that includes tscon.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant as it indicates an attacker may be trying to hijack a disconnected RDP session, posing a risk of unauthorized access. If confirmed malicious, the attacker could gain control over an existing user session, leading to potential data theft or further system compromise.
The analytic detects an unusually high number of denied Multi-Factor Authentication (MFA) requests for a single user within a 10-minute window, specifically when more than nine MFA prompts are declined. It leverages Azure Active Directory (Azure AD) sign-in logs, focusing on "Sign-in activity" events with error code 500121 and additional details indicating "MFA denied; user declined the authentication." This behavior is significant as it may indicate a targeted attack or account compromise attempt, with the user actively declining unauthorized access. If confirmed malicious, it could lead to data exfiltration, lateral movement, or further malicious activities.
This rule detects the creation or modification of ASPX/ASP files within specific SharePoint web server directories on devices identified as vulnerable to CVE-2025-49706 or CVE-2025-53770. It leverages vulnerability management data to narrow down the scope to only vulnerable SharePoint servers, then monitors file events in common SharePoint LAYOUTS paths for web shell indicators. The rule also uses file profiling to identify potentially novel or malicious ASPX/ASP files that lack Defender visibility.
Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.
A USB device with Vendor ID 0E90 is associated with vendor WiebeTech (a.k.a "CRU"), which is known to manufacture "mouse jigglers." These hardware devices can be used to prevent a computer from automatically locking the screen or going to sleep. Illegitimate use can range from policy violation to nefarious activity like remote desktop abuse.
The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or execute ransomware, leading to data theft or other severe impacts. Immediate investigation and mitigation are crucial to prevent further compromise.
Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".
The analytic detects potentially suspicious modifications to Windows Audit Policy auditing options registry values. It focuses on changes to specific auditing option values ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. Such modifications could indicate a threat actor attempting to tamper with audit policy configurations, potentially disabling SACLs (System Access Control Lists) to bypass defenses and facilitate further malicious activities like machine compromise or lateral movement.
This analytic is developed to detect suspicious registry modifications that disable Remote Desktop Protocol (RDP) by altering the "fDenyTSConnections" key. Changing this key's value to 1 prevents remote connections, which can disrupt remote management and access. Such modifications could indicate an attempt to hinder remote administration or isolate the system from remote intervention, potentially signifying malicious activity.
Hunt malicious abuse of BITS (Background Intelligent Transfer Service) for file transfers, code execution, and persistence, analyzing command-line patterns and suspicious process chains commonly used by attackers.
The following analytic detects modifications to the Windows registry that disable the Windows Defender phishing filter. It leverages data from the Endpoint.Registry data model, focusing on changes to specific registry values related to Microsoft Edge's phishing filter settings. This activity is significant because disabling the phishing filter can allow attackers to deceive users into visiting malicious websites without triggering browser warnings. If confirmed malicious, this could lead to users unknowingly accessing harmful sites, resulting in potential security incidents or data compromises.
Page 461 of 600