Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,582 detections
Filters
Last updated
All Time
Detection languages
5,138
3,901
1,034
828
476
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,444
1,825
1,661
1,578
1,416
Platforms
8,040
1,888
1,334
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,115
15,635
12,582
8,393
6,221
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
KQL Query
SPL Query from file: Failed Authentication to Non-existing Accounts
Detects the creation or modification of an Active Directory forest trust where the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag is set in TdoAttributes. This includes cases where it's set alone (0x800) or in combination with the FOREST_TRANSITIVE flag (0x808), both indicative of the AORTA attack. For more comprehensive detection, consider backend-specific bitwise checks on TdoAttributes to ensure the 0x800 bit is set, regardless of other flags.
Detects the use of 'bitsadmin.exe' to download files from domains commonly associated with file-sharing services or attacker-controlled infrastructure. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
KQL Query
This rule detects changes to the Windows Registry key that controls the Remote Desktop Protocol (RDP) port number. Specifically, it triggers when the RDP port is modified from its default value of 3389 to any other port. This activity can be indicative of an adversary attempting to evade detection, bypass network filtering, or maintain persistence by configuring RDP to listen on a non-standard port.
Researchers have identified a recurring issue where API keys, secrets, and authentication tokens are hardcoded within the JavaScript code of popular Chrome extensions. These exposed credentials are easily retrievable by inspecting the extension package, enabling threat actors to abuse associated services.
Detects potential AppDomainManager hijacking used by the OneClik APT campaign, where legitimate .NET ClickOnce applications (ZSATray.exe, umt.exe, ied.exe) load a suspicious DLL like 'history.tlb'. This technique (T1574.014) is used to load attacker-controlled assemblies and execute malicious code.
Detects the creation or modification of an Active Directory forest trust with only the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag set in TdoAttributes. This indicates the AORTA attack where TGT delegation is enabled without the trust also being marked as transitive. This complements the detection for the 0x808 value.
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc
Detects the creation of a new Active Directory forest trust with both FOREST_TRANSITIVE (0x00000008) and CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flags set, indicative of the AORTA attack. This rule specifically checks for the TdoAttributes value 0x808, which represents the exact combination of these two flags. Attackers might set additional flags, which would result in a different TdoAttributes value, potentially leading to false negatives. Consider implementing backend-specific bitwise checks if your SIEM supports them for more comprehensive detection.
Detects usage of bitsadmin downloading a file from a suspicious domain
Detects modifications to specific registry keys under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). This includes keys related to Terminal Services, Security Providers, Safe Boot, Print Monitors/Providers, Network Provider Order, and LSA Authentication/Notification Packages. Such modifications can be indicative of persistence mechanisms used by adversaries.
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or modify the security policy. This could indicate an adversary attempting to understand or alter system security configurations for persistence, privilege escalation, or defense evasion.
Detects usage of bitsadmin downloading a file from a suspicious domain
This rule detects modifications to specific Windows Registry keys that are known to be used by BlackByte ransomware for privilege escalation and to prepare for lateral movement and encryption. Specifically, it looks for the setting of 'LocalAccountTokenFilterPolicy', 'EnableLinkedConnections', and 'LongPathsEnabled' to a DWORD value of '1'. These modifications can enable administrative shares for non-administrator accounts, allow for longer file paths, and potentially facilitate ransomware operations.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring modifications to specific registry keys. This includes changes that could allow unauthorized users access via 'fAllowUnsolicited', or enabling RDP via 'fDenyTSConnections' by setting their values to 'DWORD (0x00000000)'.
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects modifications to various Windows Registry keys under `CurrentVersion` that are commonly used for autostart extensibility points (ASEPs). This includes `Run`, `RunOnce`, `RunOnceEx`, `RunServices`, `RunServicesOnce`, `ShellServiceObjectDelayLoad`, `Policies\System\Shell`, `Policies\Explorer\Run`, `Group Policy\Scripts`, `Explorer\ShellServiceObjects`, `Explorer\ShellIconOverlayIdentifiers`, `Explorer\ShellExecuteHooks`, `Explorer\SharedTaskScheduler`, `Explorer\Browser Helper Objects`, `Authentication\PLAP Providers`, `Authentication\Credential Providers`, and `Authentication\Credential Provider Filters`. Adversaries often modify these keys to establish persistence on a system by ensuring their malicious code executes automatically during system boot or user logon.
Detects modifications to the 'User Shell Folders' registry key, specifically the 'Startup' value. This technique is often used by adversaries to establish persistence by ensuring a malicious payload is launched automatically when a user logs in.
Page 476 of 600