Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,587 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
This detection looks for a method of creating potentially malicious LNK (Shortcut) files by using the CreateShortcut() function. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
The following analytic detects the creation or modification of Windows services using the sc.exe command. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because manipulating Windows services can be a method for attackers to establish persistence, escalate privileges, or execute arbitrary code. If confirmed malicious, this behavior could allow an attacker to maintain long-term access, disrupt services, or gain control over critical system functions, posing a severe threat to the environment.
This analytic detects the presence of a registry key associated with the Remcos RAT agent on a host. It leverages data from the Endpoint.Registry data model, focusing on instances where the "Software\Remcos" path is found. This behavior indicates potential compromise by the Remcos RAT, a remote access Trojan used for unauthorized access and data exfiltration. If confirmed malicious, the attacker could gain control over the system, steal sensitive information, or use the compromised host for further attacks. Immediate investigation and remediation are required.
This rule detects suspicious command-line activity related to enabling Remote Desktop Protocol (RDP) access. Specifically, it looks for `netsh.exe` commands that add a firewall rule to allow inbound TCP traffic on port 3389 (RDP) or enable the 'Windows Management Instrumentation (WMI)' firewall group. It also detects `reg.exe` commands that modify the `fDenyTSConnections` registry value to enable RDP connections.
The following analytic identifies the addition and quick deletion of a Service Principal Name (SPN) to a domain account within 5 minutes. This detection leverages EventCode 5136 from the Windows Security Event Log, focusing on changes to the servicePrincipalName attribute. This activity is significant as it may indicate an attempt to perform Kerberoasting, a technique used to crack the cleartext password of a domain account offline. If confirmed malicious, this could allow an attacker to gain unauthorized access to sensitive information or escalate privileges within the domain environment.
This analytic detects the addition of a Service Principal Name (SPN) to a domain account. It leverages Windows Event Code 5136 and monitors changes to the servicePrincipalName attribute. This activity is significant because it may indicate an attempt to perform Kerberoasting, a technique where attackers extract and crack service account passwords offline. If confirmed malicious, this could allow an attacker to obtain cleartext passwords, leading to unauthorized access and potential lateral movement within the domain environment.
This rule detects attempts to flush Shimcache using rundll32.exe, which can indicate anti-forensic activity or defense evasion by an attacker. The detection logic specifically looks for command-line arguments associated with flushing the Shimcache, including function names like "ShimFlushCache" or "BaseFlushAppcompatCache", and also checks for ordinal values combined with specific DLLs like "apphelp.dll" or "kernel32.dll".
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Detects the addition of a member to a sensitive Active Directory group related to VMware administration (e.g., 'vSphere Admins', 'ESX Admins') using net.exe executed via WinRM (wsmprovhost.exe). This behavior is a key TTP used by threat groups like UNC3944 to escalate privileges and gain control over the vSphere environment after an initial compromise.
Detects the creation of the "spinstall0.aspx" web shell in a SharePoint server directory, which is a known post-exploitation indicator for the SharePoint vulnerability CVE-2025-53770.
This rule detects when a user is added to an administrative or management role in Azure Active Directory outside of defined business hours. It specifically looks for 'Add member to role completed' or 'Add app role assignment grant to user' operations where the target role contains 'admin' or 'Manage', and the event occurs outside of the configured business hours (7 AM to 6 PM local time, Monday to Friday).
Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
Detect Registry Addition to RunMRU Key - Detect creation or modification of values under the RunMRU key, which stores the history of executed commands via the Run dialog (Win + R). Attackers may use this to track user actions or store malicious command history for reuse.
Detects malicious DLLs (ffmpeg.dll, libvlc.dll) used for sideloading by a China-nexus APT in the 'Illusory Wishes' campaign targeting the Tibetan community.
This rule detects the execution of common command and scripting interpreters (cmd.exe, cscript.exe, powershell.exe, pwsh.exe, powershell_ise.exe, wmic.exe, wscript.exe) when their parent process is either w3wp.exe or svchost.exe, and the command arguments contain keywords related to SharePoint. This behavior can indicate suspicious activity within a SharePoint environment, potentially related to web shell execution, privilege escalation, or data exfiltration.
Detects the DLL sideloading of malicious DLLs (ffmpeg.dll, libvlc.dll) by legitimate applications (Element.exe, VLC.exe) as observed in the 'Illusory Wishes' campaign.
The following analytic detects instances where a Duo admin login originates from a country outside of the United States, which may indicate suspicious or unauthorized access attempts. It works by analyzing Duo activity logs for admin login actions and filtering out events where the access device's country is not within the expected region. By correlating user, device, browser, and location details, the analytic highlights anomalies in geographic login patterns. This behavior is critical for a SOC to identify because admin accounts have elevated privileges, and access from unusual countries can be a strong indicator of credential compromise, account takeover, or targeted attacks. Early detection of such activity enables rapid investigation and response, reducing the risk of unauthorized changes, data breaches, or further lateral movement within the environment. The impact of this attack can be severe, potentially allowing attackers to bypass security controls, alter configurations, or exfiltrate sensitive information.
Identifies unsigned processes creating scheduled tasks, a common persistence mechanism for malware. **Validation**: Very High - Legitimate task creation is typically done by signed system utilities.
This detection identifies known malicious file hashes associated with SharePoint exploitation campaigns. These hashes correspond to web shells and post-exploitation tools observed in attacks by threat actors like Storm-2603.
The analytic detects when a Duo policy is created or updated to allow network-based bypass of two-factor authentication (2FA). It identifies this behavior by searching Duo administrator logs for policy creation or update actions where the networks_allow field is present, indicating that specific networks have been permitted to bypass 2FA requirements. This is achieved by parsing the event description and filtering for relevant policy changes, then aggregating the results by user and administrator details. Detecting this behavior is critical for a Security Operations Center (SOC) because allowing network-based 2FA bypass can significantly weaken authentication controls, potentially enabling unauthorized access if a trusted network is compromised or misconfigured. Attackers or malicious insiders may exploit this policy change to circumvent 2FA protections, increasing the risk of account takeover and lateral movement within the environment. Prompt detection enables SOC analysts to investigate and respond to potentially risky policy modifications before they can be leveraged for malicious purposes.
Page 462 of 600