Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,395 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,691
1,318
905
813
745
Platforms
5,923
913
884
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
The following analytic detects potential RDP Hijacking attempts by identifying the creation of a Windows service using sc.exe with a binary path that includes tscon.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant as it indicates an attacker may be trying to hijack a disconnected RDP session, posing a risk of unauthorized access. If confirmed malicious, the attacker could gain control over an existing user session, leading to potential data theft or further system compromise.
The following analytic detects the creation of the comadmin.dat file in the %windows%\system32\Com directory, which is associated with Snake Malware. This detection leverages the Endpoint.Filesystem data model to identify file creation events matching the specified path and filename. This activity is significant because the comadmin.dat file is part of Snake Malware's installation process, which includes dropping a kernel driver and a custom DLL. If confirmed malicious, this activity could allow an attacker to load a malicious driver, potentially leading to privilege escalation and persistent access to the compromised system.
The following analytic detects the creation of a new service named WerFaultSvc with a binary path in the Windows WinSxS directory. It leverages Windows System logs, specifically EventCode 7045, to identify this activity. This behavior is significant because it indicates the presence of Snake malware, which uses this service to maintain persistence by blending in with legitimate Windows services. If confirmed malicious, this activity could allow an attacker to execute Snake malware components, leading to potential data exfiltration, system compromise, and long-term persistence within the environment.
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
Detects when a user has either been assigned or removed from an Admin/Privileged role. Providing the analyst with the relevant event information for further investigation.
Detects a system shell/interpreter copied or moved into a writable or non-standard path -
the precursor to the 'copy /bin/bash, set SUID, run bash -p' misconfiguration abuse and a
common staging step in the page-cache PoCs. Enriched with source/destination decode, an
inline-SUID-intent flag (chmod +s / chmod 4755 / install -m / setcap in the same command),
masquerade flags (renamed, hidden dotfile, system-lookalike name), a weighted RiskScore /
TriagePriority and DeviceInfo context. Pairs with OS-DET-LNX-006 and correlation
OS-DET-LNX-007. Detection logic adapted from Elastic Security Labs.
the precursor to the 'copy /bin/bash, set SUID, run bash -p' misconfiguration abuse and a
common staging step in the page-cache PoCs. Enriched with source/destination decode, an
inline-SUID-intent flag (chmod +s / chmod 4755 / install -m / setcap in the same command),
masquerade flags (renamed, hidden dotfile, system-lookalike name), a weighted RiskScore /
TriagePriority and DeviceInfo context. Pairs with OS-DET-LNX-006 and correlation
OS-DET-LNX-007. Detection logic adapted from Elastic Security Labs.
Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.
One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.
One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.
Detects the creation of GCP compute instances that are attached to service accounts with broad 'cloud-platform' scope permissions. This activity is monitored to ensure that only authorized automation service accounts (e.g., IaC pipelines) are performing these actions, as creating instances with highly privileged service accounts can be a technique used to escalate privileges or establish persistence.
Detects a non-root user invoking 'busctl call' against the system bus - the core of the
ptrace_may_dream / AccountsService abuse path (CVE-2026-46333 class). Enriched by decoding
the D-Bus call target (service/member), a CallCategory verdict (AccountsService account
modification, systemd run-as-root, polkit, PackageKit, generic mutating call), a burst
counter that surfaces the pidfd_getfd race loop, RiskScore / TriagePriority and DeviceInfo
context. NOTE: the FD-theft primitive itself is invisible to MDE; this detects the busctl
trigger and account-modification aftermath. Detection logic adapted from Elastic Security Labs.
ptrace_may_dream / AccountsService abuse path (CVE-2026-46333 class). Enriched by decoding
the D-Bus call target (service/member), a CallCategory verdict (AccountsService account
modification, systemd run-as-root, polkit, PackageKit, generic mutating call), a burst
counter that surfaces the pidfd_getfd race loop, RiskScore / TriagePriority and DeviceInfo
context. NOTE: the FD-theft primitive itself is invisible to MDE; this detects the busctl
trigger and account-modification aftermath. Detection logic adapted from Elastic Security Labs.
High-fidelity correlation of OS-DET-LNX-005 and OS-DET-LNX-006: a system shell copied to a
non-standard/writable path, followed within 15 minutes on the same host by execution of a
shell with the privilege-preserving -p flag from a non-standard path. The two events
together are a near-certain SUID-root shell misconfiguration abuse (bash -p to root) and a
lower-FP signal than either component alone. Detection logic adapted from Elastic Security Labs.
non-standard/writable path, followed within 15 minutes on the same host by execution of a
shell with the privilege-preserving -p flag from a non-standard path. The two events
together are a near-certain SUID-root shell misconfiguration abuse (bash -p to root) and a
lower-FP signal than either component alone. Detection logic adapted from Elastic Security Labs.
Detects 'unshare' creating a user/mount/net namespace by a non-root user, outside
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
sanctioned container and sandbox runtimes. This is the shared precursor across CIFSwitch,
OVSwrap, pedit COW and container escapes. Enriched with a namespace-flag decode, an
exploit-family ProfileHint (user+net = OVSwrap shape, user+mount = CIFSwitch/overlay
shape), sandbox-lineage FP suppression, RiskScore / TriagePriority and DeviceInfo context.
Treat as a precursor/triage signal - MDE cannot tie unshare to the subsequent root
transition (no uid_change event). Detection logic adapted from Elastic Security Labs.
Detects creation or modification of files under /etc/sudoers or /etc/sudoers.d/ by a
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
Detects modifications to IAM role trust policies (UpdateAssumeRolePolicy) or the creation of new roles (CreateRole) where the Principal is configured with a wildcard or generic open access. This configuration enables any AWS account to assume the role, representing a significant risk for privilege escalation and persistence establishment by attackers.
Detects potential Golden Ticket forgery or malicious Kerberos activity by monitoring Windows Security Event IDs 4768 (TGT) and 4769 (TGS). The rule identifies suspicious characteristics including the use of weak encryption (RC4) where AES is preferred, specific ticket option flags commonly associated with Mimikatz, and unusually long ticket lifetimes that deviate from standard domain policies.
Detects cloud service principals identified as AI agents or assistants performing sensitive API operations such as IAM policy modifications or storage configuration changes. This pattern may indicate that an AI service account has been compromised or misused to perform reconnaissance, privilege escalation, or persistence, exceeding its intended scope of operation.
Detects the execution of Python 3.12 commands via 'sudo' to elevate privileges to 'root'. The rule monitors for instances where a non-root account invokes 'sudo python3.12' and subsequently spawns a process or logs activity confirming a root-level execution session within a short time window.
Detects non-interactive 'sudo -n' used to test for or invoke a passwordless sudo rule
(e.g. 'sudo -n true', 'sudo -n -l', 'sudo -n bash'). Directly follows the sudoers write in
the OVSwrap (CVE-2026-64531) chain and is a common post-exploit validation step.
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
(e.g. 'sudo -n true', 'sudo -n -l', 'sudo -n bash'). Directly follows the sudoers write in
the OVSwrap (CVE-2026-64531) chain and is a common post-exploit validation step.
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
Detects instances where the suspicious binary 'x47_bot.exe' performs process injection or hollows a process, followed by an attempt to gain or elevate privileges (such as via UAC bypass, token manipulation, or privilege checking) on the same host within a 15-minute window.
Detects instances where the suspicious binary 'x47_bot.exe' performs process injection or hollows a process, followed by an attempt to gain or elevate privileges (such as via UAC bypass, token manipulation, or privilege checking) on the same host within a 15-minute window.
Detects the creation of GCP compute instances that are attached to service accounts with broad 'cloud-platform' scope permissions. This activity is monitored to ensure that only authorized automation service accounts (e.g., IaC pipelines) are performing these actions, as creating instances with highly privileged service accounts can be a technique used to escalate privileges or establish persistence.
Detects 'Add member to role' operations in Entra ID where high-privileged directory roles are assigned to a user or service principal. This pattern is often a critical indicator of privilege escalation in account compromise scenarios where an attacker attempts to elevate their own or a secondary account's permissions within the tenant.
Page 12 of 400