Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,395 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,691
1,318
905
813
745
Platforms
5,923
913
884
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the creation, modification, or deletion of scheduled tasks with specific names known to be used by the SVR-affiliated GraphicalProton backdoor. The rule monitors Windows Security Event IDs 4698 (A scheduled task was created), 4699 (A scheduled task was deleted), and 4702 (A scheduled task was updated) for a predefined list of suspicious task names.
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects modifications to shell context menu commands within the Windows Registry. This rule is designed to identify potential persistence mechanisms or suspicious activity where an attacker might alter the commands executed when a user interacts with files or folders via the right-click context menu. The detection specifically looks for changes in registry paths containing '\Software\Classes\', '\shell\', and '\command\', which are indicative of context menu command definitions.
Detects suspicious modifications to the SentinelOne context menu scan command in the Windows Registry. This rule specifically looks for changes made by processes other than the legitimate SentinelOne agent, indicating potential tampering or persistence mechanisms.
Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.
Detects potential use of Rubeus via registered new trusted logon process
Detects when an access level is changed for a Google Workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary could remove access levels to gain easier access to Google Workspace resources, potentially leading to persistence or privilege escalation.
Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects an exploitation attempt of CVE-2019-1388, a privilege escalation vulnerability. This involves the UAC consent dialogue (consent.exe) invoking an Internet Explorer process (iexplore.exe) with system-level privileges, indicated by 'System' or 'S-1-16-16384' integrity level and a command line containing ' http'.
Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability. This rule specifically looks for instances where a command interpreter (cmd.exe, powershell.exe, or pwsh.exe) is spawned as a child process of the Microsoft Edge elevation service (elevation_service.exe) with SYSTEM integrity level, indicating a successful privilege escalation.
Detects remote thread creation in the 'mstsc.exe' process by a process originating from a suspicious temporary or public user directory. This technique is often used by attackers to inject code into 'mstsc.exe' to hook APIs and steal credentials during RDP authentications.
This rule detects a specific User Account Control (UAC) bypass technique often associated with UACMe (specifically method 22). It triggers when 'werfault.exe' is spawned with high or system integrity levels, and its parent process is 'consent.exe'. This indicates an attempt to elevate privileges by exploiting a vulnerability in how consent.exe handles process creation, leading to an auto-elevated werfault.exe.
This rule detects a specific User Account Control (UAC) bypass technique that leverages the Disk Cleanup utility (cleanmgr.exe) in conjunction with scheduled tasks. The detection logic looks for a process creation event where 'cleanmgr.exe' is executed with the '/autoclean /d C:' arguments, and its parent process is 'svchost.exe -k netsvcs -p -s Schedule', indicating it was launched by the Task Scheduler service. Furthermore, the rule specifies that the integrity level of the 'cleanmgr.exe' process must be 'High' or 'System', which is indicative of an elevated process, thus confirming a successful UAC bypass. This technique is associated with UACMe method 34.
This rule detects attempts to bypass User Account Control (UAC) using the Microsoft Connection Manager Profile Installer (CMSTP) by abusing specific autoelevate-capable COM objects. The detection logic looks for processes where 'DllHost.exe' is the parent process, the parent command line contains specific COM Process IDs associated with CMSTP or related components, and the process is running with 'High' or 'System' integrity levels. This technique is often used by adversaries to elevate privileges without user interaction.
Detects the execution of 'wsreset.exe' with elevated privileges (High or System integrity levels). This behavior is indicative of a User Account Control (UAC) bypass attempt, as 'wsreset.exe' is a legitimate Windows utility that can be abused to elevate privileges without a UAC prompt.
This rule detects attempts to escalate privileges by modifying Windows service configurations using 'sc.exe' from a non-administrative context (Medium integrity level). Specifically, it looks for modifications to a service's 'binPath' (ImagePath) or 'FailureCommand', which could allow an attacker to execute arbitrary code with elevated privileges when the service starts or fails.
This rule detects attempts to bypass User Account Control (UAC) using the 'ComputerDefaults.exe' utility, specifically when it is executed with elevated integrity levels (High or System) and not as a child process of common system directories like 'System32' or 'Program Files'. This behavior is characteristic of UAC bypass tools such as UACMe (method 59).
Detects a specific User Account Control (UAC) bypass technique leveraging 'ieinstal.exe' as a parent process. The rule looks for processes with 'High' or 'System' integrity levels, where the parent process is 'ieinstal.exe' and the created process is 'consent.exe' located in a temporary directory ('\AppData\Local\Temp\'). This pattern is characteristic of the UACMe tool's method 64.
This rule detects a specific User Account Control (UAC) bypass technique that involves `pkgmgr.exe` launching `dism.exe` with elevated integrity levels. This behavior is characteristic of UACMe, a tool used to discover and implement UAC bypasses. The rule specifically looks for `dism.exe` being spawned as a child process of `pkgmgr.exe` and operating at 'High' or 'System' integrity levels, or their corresponding Security Identifier (SID) representations.
This rule detects suspicious child processes spawned by the Windows Print Spooler service (spoolsv.exe) running with System integrity. The detection logic specifically looks for the execution of various Windows utilities and command-line interpreters (like cmd.exe, powershell.exe, net.exe, wmic.exe, certutil.exe, bitsadmin.exe, rundll32.exe, etc.) that are commonly abused by attackers for execution, privilege escalation, or reconnaissance after exploiting vulnerabilities in the Print Spooler service (e.g., PrintNightmare). The rule includes filters to reduce false positives for some commands.
Detects a specific User Account Control (UAC) bypass technique that leverages the 'changepk.exe' and 'slui.exe' executables. This method is associated with UACMe bypass technique #61, where 'slui.exe' is used as a parent process to launch 'changepk.exe' with elevated privileges, bypassing the UAC prompt. The rule specifically looks for 'changepk.exe' being spawned by 'slui.exe' with an integrity level of 'High' or 'System'.
Page 382 of 400